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SUMMARY OF SUBJECT MATTER 

TO: Members, Subcommittee on Aviation 

FROM: Staff, Subcommittee on Aviation 

RE: Subcommittee Hearing on “Lessons Learned from the Boeing 787 Incidents” 

PURPOSE 

The Subcommittee on Aviation will meet on Wednesday, June 12, 2013, at 10:00 a.m. in 
2167 Rayburn House Office Building to receive testimony in order to explore and discuss “lessons 
learnt” as a result of the Boeing 787 battery incidents that occurred in January 2013. Hie 
Subcommittee will hear from the Federal Aviation Administration (FAA) and The Boeing 
Company (Boeing) on actions taken as a result of and lessons learned from the 787 battery 
incidents. 


BACK<?RQVNP 


Summary of Incidents and Response 

On January 7, 2013, cleaning personnel discovered smoke while working on a J^ian 
Airlines (JAL) Boeing 787 that was parked at a gate at Boston Logan International Airport. The 
aircraft had recently landed at the airport after a flight from Narita, Japan. The aircraft had been 
deplaned of passengeis and crew when the cleaning crew boarded the plane and reported smelling 
smoke. When a mechanic opened the aft electronic equipment bay, he found heavy smoke and flie 
coming from the front of the auxiliary power unit (APU) battery' case {Figure Jy He indicated that 
the fire had two distinct flames that were about diree inches in length at the two connectors on the 
front of the battery case.^ The mechanic was unsuccessful in extinguishing the fire. Airport 
firefighters extinguished the fire about an hour and forty minutes after initial notification.^ 


* The auxiliary powar unit battwy provides power to start an APU during ground and flight operations. The APU battery 
is one of two lithium ion b^taies used on &e 787. While lithium ion batteries have been used on planes prior to the 
787, the 78? uses laige^ batteries fw scane mun electrical functions on the aircraft. 

^ Natifmal Transportation Safety Board (NTSB) Interim Facttial Report, NTSB Case Number: DCAi3IA037, page 1 
(March 7, 2013). 

’M-atl 
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In response to the JAL 787 battery fire at Boston Logan International Airport, the National 
Transportation Safety Board (NTSB) sent a “go-team” to investigate the incident. The lithium-ion 
battery cells involved in the fire were transported to the NTSB forensics lab in Washin^on, D.C., 
for further investigation. Both the FAA and Boeing are parties to the ongoing NTSB investigation. 

In the days following the JAL 787 battery incident, several other incidents were reported on 
787 aircraft in commereial service. These incid^ts were not related to the 787 batteries. However, 
these incidents, along with the JAL 787 battery iiK:ident, prompted the FAA on January 11, 2013, to 
order a comprehensive review of the 787’s critical systems, including the design, construction, and 
assembly of the battery components of die aircraft. 

On January 15, 2013, an AU Nippon Airways 787, during a domestic flight in Japan, 
experiertced a problem with its main battery (Figure /).* According to the carrier, the main battery 
in the forward cargo hold triggered an emergency warning to the pilot. This warning was followed 
by a second warning light in the cockpit diat indicated smoke. According to passengers and crew, 
there was an odd smell in the cockpit and cabin. The pilot decided to make an emergency landing 
and evacuate all passengers and crew via inflated chutes. While there was no fire when the plane 
landed, there was discoloration and signs of leakage in the main battery. 

Following die battery Incident aboard the All Nippon Airways 787, the Japan Transport 
Safety Board (J’reB) opened an investigation into the incident and both Japanese air carriers 
operating 787 aircraft (Japan Airlines and All Nippon Airways) voluntarily grounded their fleet of 
787’s onJanumy 16, 2013. 

Later tiiat same day, the FAA issued an Emergency Airworthiness Directive (AD) to address 
a potential tettery fire risk in the 787, which required operators to temporarily cease operations.^ At 
the same time, the FAA announced that it would work with the manufecturer and air carriers to 
develop a corrective action plan to allow the U.S. 787 fleet to resume operations as quickly and 
safely as possible. Aviation regulatory agencies of other coimtries in which the 787 operated 
quickly followed suit, with temporary groundings ordered in Japan, the European Union, India, 
Qatar, Ethiopia, Kenya, and Chile. Boeing responded by sending teams of investigators and 
engineers to both incident sites to compile information and, in coordination with the FAA, devise a 
solution to return the 787’s back to service. In April, the NTSB held a two-day investigative hearing 
in connection to its investigation of the January 7, 2013 JAL 787 battery incident. The NTSB’s final 
report should be complete by the end of the year. 


^ The main battery provides power to selected electrical/electronic equipment during ground and flig^ operations for 
normal and iailtue conditions. 

® Boeing Model 787-8 FAA Emeigency Airworthiness Directive, AD #: 2013-02-51, January 16, 2013. 
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FIGURE!: 



Aii^raft Certifwation 

In exercising its discretion* the FAA has devised a system of compliance review that 
involves certilBcation of aircraft design and manufacture. Under this certification process, the duty 
to ensure that an aircraft conforms to FAA safety regulations lies with the manufacturer and 
operator, while the FAA retains responsibility for overseeing compliance. Thus, the manuf^turer is 
required to develop the plans and specifications and perform the ii^pections and tests necessary to 
establish that an aircraft design comports with the regulations; the FAA then reviews the data by 
conducting a risk based review of the manufecturcr’s work. If the FAA finds that a proposed new 
type of aircraft comports with minimum safety standards, it signifies its approval by issuing a type 
certificate. 

When a new design of aircraft is being proposed, such as the Boeing 787, the designer must 
first apply to the FAA for a type certificate. The applicant must show that the aircraft, aircraft 
engine, or propeller concerned meets the applicable existing airworthiness requirements. The 
regulations also provide for the issuance of special conditions when the Administrator finds that the 
existing airworthiness standards do not contain adequate or ^propriate safety standards because of 
novel or unusual design features of the product to be type certificated. In the interest of safety, rapid 
technological advances presently being made by the civil aircraft industry require th^ the FAA be 
able to issue special conditions to address truly novel or unusual design features that it has, as yet, 
not had an adequate opportunity to include in the airworthiness standards through the general 
rulemaking process. For example, in the Boeing 7S7*s case, the lithium-ion battery is a newer 
technology that is not specific^y covered by existing regulatory standards. Therefore, the FAA 
developed special conditions that ensured a comparable level of safety with the standards that were 
in place at the time of certification. In order to receive a type certificate, the applicant must conduct 
a series of tests and reviews to show that the product is compliant with existing standards and the 
si^ial conditions. This includes lab tests, flight tests, conformity inspections, and detail- and 
airplane-level compliance findings, all of which are subject to FAA oversight. 

Along with seeking a type certificate, the applicant can simultaneously seek a production 
certificate from the FAA. A production certificate is an approval by the FAA to manufacture 
duplicate products of the type design approved by the type certificate. Before approving a 
production certificate, the FAA will review the manufacturer’s quality control systems against 
regulatory and policy requirements. The holder of die production certificate is responsible for the 
quality of all parts, even those that are not specifically manufactured by the production certificate 
holder. In other woids, a manufacturer may not produce all the parts on their aircraft, but ftiey are 
responsible for the quality of each item on the plane. 


3 



FIGURE 2; 


vii 


Aircraft Certification Process 
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Source; FAA 


In order to ensure that all parts meet quality standards, the FAA also has the abili^ to grant 
a company Organization Designation Authorization (ODA). The ODA allows a company to set up 
an organization of airworthiness representatives (AR’s) who act on behalf of the FAA. The 
company and the FAA develop a procedures manual, which is the guiding document on the 
procedures, processes, and practices for the company. The AR’s are authorized by the FAA and 
usually carryout routine certification actions. The FAA inspectors have the authority to perfoim any 
of these activities themselves should they wish to, or they can delegate the responsibility to the AR. 
AR’s are approved by the FAA after going through a review process and are responsible for 
ensuring the manufacturers’ compliance to FAA standards. The FAA has multiple processes that 
must be met to ensure that a new aircraft meets the standards of aircraft design and manufacturing. 
Boeing does have an ODA. 

Boeing applied for a type certificate for the 787-8 airplane in March 2003. More than eight 
years later, in August 201 1, the 787-8 airplane received transport-category approval from the FAA. 
Because the 787 was utilizing new and novel lithium-ion battery technology for the main and APU 
batteries, the FAA also issued special conditions for the 787 lithium-ion battery installation in 
October 2007.’ 


On January 1 1, 2013, in response to the JAL 787 battery incident and to other reported 
issues, the FAA announced it was going to conduct a comprehensive review of the 787’s critical 
systems, including (he design, construction, and assembly of the battery components of the aircraft. 
In particular, the FAA indicated that “. . .the purpose of the review was to validate the work 


25-359-SC, 72 Federal Register 57842 (October 1 1, 2007); became effective on November 13, 2007. 
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conducted during the certification process and further ensure that the aircraft meets the FAA’s high 
level of safety.”^The FAA has coordiimted closefy with Boeing in conducting the 787 critical 
systems and certification review and the work is ongoing. 

Return to Service 

The January 16, 2013 airworthiness directive ordered the temporary cessation of 787 
operations. The emergency AD specifically directed air carriers, before further flight, to “...modify 
the battery system, or take other Elions, in accordance with a method ^proved by the Manager, 
Seattle Aircraft Certification Office.”® The FAA indicated that it would work with the manufecturer 
and opeiatoi^ to develop a plan to allow 787*s to resume operations as quickly and safely as 
possible. While the NTSB investigation was ongoing, the FAA and Boeing detennined to move 
ahead witii a comprehensive solution plan. Tliey understood the sequence of events (a short circuit 
in one cell that propagated to other cells), but the actual cause of the short circuit remained 
unknown. That having been said, Boeing was able to narrow the cause of the short circuit to four or 
five potential causes. On February 1 7, 201 3, Boeing submitted a comprehensive certification and 
design plan to the FAA for its review and approval. The plan included the following mitigation 
actions: 

• At die battery cell level: They made design changes to the battery cells to reduce the ch^<re 
of a ^ort circuit {Figure 3), 

• At the battery level: They proposed design changes to stop propagation from cell-to-cell 
(reduce the chance for cell-to-cell contact and the buildup of moisture) (Figure 3); and 

• At die aircraft level: They improved the battery containment components to allow the 
venting of gases outside of the plane in the event of a battery short circuit (this was intended 
to do three things; prevent gases from entering the cabin; reduce the chance of ccll-to-cell 
propagation; and preclude the possibility of a fire)( Figure 3), 


* FAA f^5 Release, “FAA Will Review Boeing 787 Design and Production**, January 11,2013. 

^ Boeing Model 787-8 FAA Emergency Airworthiness Directive, AD H: 2013-t>2-5!, January 16, 2013. 
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FIGURE 3: 


Comprehensive Set of Solutions: Battery 



Source; Boeing 

The FAA approved the initial plan on March 1 2, 201 which allowed Boeing to make 
alterations to the batteries on a 787 aircraft for test flight. On March 25, 2013, the FAA authorized a 
series of test flights. After the tests proved successful, Boeing submitted a final certification plan for 
the upgraded batteries to the FAA on April 8, 2013. 

After further review by the FAA, the final plan was approved on April 19, 2013, and a 
modified AD vras issued on April 26, 2013. The modified AD allowed for 787 aircraft to return to 
commercial service upon completion of the steps outlined in the certification plan. The AD and the 
updated certification plan did not affect the 787’s original type and production certificates; the 
batteiy update as outlined in the certification plan is not considered a major design change and 
therefore does not require an amended type certificate. 

Following the issuance of the AD allowing 787 aircraft to return to commercial service, 
other aviation regulatory authorities that had similar orders lifted them. Ethiopian Airlines was the 
first to return their aircraft to service on April 28, 2013. As of June 5, 2013, all 50 787*s have 
received the battery modification, and have been returned to their respective operator and returned 
to commercial service. Delivery of the 787 has resumed as well, with all newly delivered aircraft 
containing the modified battery as prescribed by the AD. 

Lessons Learned from Boeing and FAA Reviews 

In the five months that have passed since the 787 battery incidents, the Committee on 
Transportation and Infrastructure has closely monitored all actions taken by the FAA, tee NTSB, 
and Boeing. Below are some, but not all, of the lessons that have been learned so far. 

• Lifhinm-lott Battery Testing: The incidents advanced the understanding of lithium-ion 
batteries and their use in airplanes. Specifically, while the initial certification testing was 
extensive and reflected state of the art practices at the time, the FAA and Boeing developed 
additional testing methods. Boeing, the FAA, and industry stakeholder have also identified 
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ways to enhance the battery’s design and manufacturing processes, and these enhancements 
have been incorporated into Boeing’s comprehensive battery solution. 

• Commanication: While the “multi-tiered supplier” dynamic is not new to the Boeing 787, 
the FAA has determined that it needs to spend more time improving communication 
horizontally and vertically to ensure a clear traceability of all required changes down the 
supplier chain and to ensure that all instructions are clearly communicated along the chain. 

WITNESS LIST 


Panel 1 


Ms. Margaret Gillian 
Associate Administrator for Aviation Safety 
Federal Aviation Administration 

Panel 2 


Mr. Mike Sinnett 

Chief Engineer for the 787 Program 
Boeing 
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LESSONS LEARNED FROM THE BOEING 787 

INCIDENTS 


WEDNESDAY, JUNE 12, 2013 

House of Representatives, 

Subcommittee on Aviation, 
Committee on Transportation and Infrastructure, 

Washington, DC. 

The subcommittee met, pursuant to notice, at 10:00 a.m. in Room 
2167, Rayburn House Office Building, Hon. Frank A. LoBiondo 
(Chairman of the subcommittee) presiding. 

Mr. LoBiondo. Good morning. The hearing will come to order. 
Thank you all for being here. The top priority of the Aviation Sub- 
committee, as well as me, personally, is the safety of the flying 
public. Therefore, the subcommittee has closely monitored the ac- 
tions of the FAA, the NTSB, and Boeing, in response to the battery 
incidents that took place earlier this year. We have called this 
hearing to learn more about the FAA and Boeing’s actions to get 
aircraft back to safe operation. 

As we all know, in January there were two separate incidents in- 
volving a lithium ion battery on Boeing 787 aircraft, one on the 
ground in Boston and the second in the air over Japan. After order- 
ing a review of all Boeing 787 critical systems, the Federal Aviation 
Administration issued an emergency airworthiness directive that 
temporarily halted the operations of 787s. 

In the 5 months since the incidents, the FAA and Boeing have 
worked to develop a comprehensive solution to the battery issues, 
and have safely returned the 787 aircraft to service. As a key part 
of this process, the FAA and Boeing have taken a hard look at the 
certification of the 787. This review has focused on what worked, 
given that the safety of the aircraft itself was not compromised in 
either incident, and what needs or needed to be improved or ad- 
justed. 

Although the NTSB investigation is ongoing, and the board has 
not identified the exact cause of the battery failure, Boeing has 
been able to narrow the possible causes of this short circuit to four 
or five basic things that they think were the cause. Based on that 
information, Boeing developed a comprehensive solution that ad- 
dresses all of these possible causes. The solution presented to the 
FAA addresses issues at the battery cell, battery, and aircraft lev- 
els. In the end, a new battery design underwent over 200,000 engi- 
neering hours, and were then subject to a rigorous testing and FAA 
approval process. 

Once again, the committee has been closely monitoring the ac- 
tions taken by the FAA and Boeing. Initially there was great con- 

( 1 ) 
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cern about the possible implications of these incidents. In the last 
5 months, we have made every effort to ensure that the FAA and 
Boeing are working together to develop a comprehensive solution. 

Therefore, the subcommittee has met several times with rep- 
resentatives of both the FAA and Boeing, and received high-level 
briefings on the incidents and the comprehensive solution. Chair- 
man Shuster, Ranking Member Rahall, Ranking Member Larsen 
and I received briefings by Boeing’s CEO during the early stages 
of the investigation. The subcommittee has remained informed 
about the actions being taken by Boeing and the FAA at every step 
of the process. 

Moving forward, this subcommittee will continue to monitor the 
FAA certification process and the 787. To assist in this effort today 
we will hear from the FAA and Boeing on lessons learned as a re- 
sult of the 787 battery incidents, and the comprehensive certifi- 
cation review. This hearing is not about attempting to lay blame 
on anyone. Instead, today we will take a constructive look at what 
has been learned from these incidents. 

It is important to remind ourselves that the United States avia- 
tion system is the safest in the world. This is due to the dedication 
and commitment of all stakeholders who, in situations like this, 
work together to ensure safety of the flying public. I would like to 
thank both the FAA and Boeing for their participation today, and 
look forward to their testimony. 

I would like to ask unanimous consent that all Members have 5 
legislative days to revise and extend their remarks and include ex- 
traneous material for the record. 

[No response.] 

Mr. LoBiondo. Without exception, so ordered. I would now like 
to yield to Mr. Larsen for any statement you may make. 

Mr. Larsen. Thank you, Mr. Chairman, for calling today’s hear- 
ing to review lessons learned from the Boeing 787 incidents. 

Mr. Chairman, I believe we should start this hearing by acknowl- 
edging that we are in an incredibly safe period for U.S. commercial 
aviation. We haven’t had a fatal commercial passenger accident in 
the U.S. since 2009, and we owe a great deal of credit for that to 
dedicated safety professionals at agencies like the FAA and the 
NTSB. 

Additionally, The Boeing Company has been a world leader in 
the airplane business for almost a century. It has maintained its 
leadership by making safety a priority. The Boeing 787 pushed the 
technological envelope. The certification itself was an 8-year proc- 
ess. The lithium ion batteries, like many of the aircraft’s design 
features, are new and a constantly evolving technology, not specifi- 
cally covered by existing FAA regulations. 

We know the FAA worked with Boeing to develop special condi- 
tions that would ensure the safety of this new technology, and the 
process for developing these special conditions was collaborative, 
rigorous, and transparent. These conditions took over a year to de- 
velop, and were published in the Federal Register for public com- 
ment. 

Nevertheless, we had two serious safety incidents involving Boe- 
ing 787 lithium ion technology in roughly a week’s time. These inci- 
dents caused the FAA and other international regulators to ground 
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the 787 for more than 3 months. The grounding raised legitimate 
questions for the flying public about whether the certification proc- 
ess with the 787 worked as well as it should have. 

In response to these two incidents, Boeing devoted more than 
200,000 engineering hours to understand the cause of these inci- 
dents and develop technical solutions to prevent or mitigate any 
further incidents. And, likewise, the FAA stepped up its own in- 
volvement in the testing and analysis activities required to certify 
the new battery design. As a result, the 787 modifications certified 
by the FAA have been completed, and all the airplanes are now 
back in service. 

Mr. Chairman, we both agree that safety is always this sub- 
committee’s highest priority. With the 787 flying safely again, now 
is the appropriate time for the subcommittee to review these inci- 
dents and glean lessons learned that could further improve avia- 
tion safety. 

In April, the Government Accountability Office raised concerns 
before the Senate Commerce Committee that the “FAA staff have 
not been able to keep pace with industry changes and, thus, may 
struggle to understand the aircraft or equipment they are tasked 
with certificating.” The NTSB’s independent investigation of the 
January 7 Japan Airlines incident is exploring this key issue, and 
that should be completed later this year. The FAA is conducting its 
own review of the 787 certification process. 

Looking forward. Congress must ensure that the FAA is ade- 
quately staffed, the agency is positioned to understand and to chal- 
lenge assumptions put forward by manufacturers regarding new 
technologies. I hope to hear from the FAA and from Boeing today 
about how the special conditions for the 787 were developed, and 
whether they were strict enough. I would also want to investigate 
whether the resources required for recertification of the 787 were 
enough. 

In February I expressed concern that this subcommittee — at our 
subcommittee’s FAA reauthorization hearing that sequestration 
could negatively affect FAA certification activities. I would like to 
hear from Ms. Gilligan whether she believes that sequestration, 
budget cuts, and hiring freezes are impairing the FAA’s ability to 
attract and retain technical competencies required to certify new 
technologies. 

Also, I would like to hear about the FAA’s efforts to retain inde- 
pendent technical expertise from outside the agency when nec- 
essary to assist in the certification of new technologies. 

Lastly, I hope that we will have time to investigate the lessons 
learned from this process, and how the FAA will certify aircraft 
with lithium ion batteries in the future. 

Thank you, Mr. Chairman, and I look forward to hearing from 
our witnesses. 

Mr. LoBiondo. Thank you, Mr. Larsen. I would now like to turn 
to the chairman of the full committee, Mr. Shuster. 

Mr. Shuster. Thank you, and thank you. Chairman LoBiondo 
and Ranking Member Larsen, for holding this hearing today. I ap- 
preciate the fact that our witnesses from the FAA and Boeing are 
here to testify before us. And as Chairman LoBiondo said, this is 
a constructive hearing, something we can learn from. 



4 


When we look at the United States and the transportation sys- 
tem, the airline system, aviation system safely transports over 730 
million passengers a year, 70,000 flights a day. So it is the safest 
aviation system in the world, and that is due to the work and the 
efforts of the FAA, the airlines, the manufacturers, the controllers, 
other operators and stakeholders who make it a safe system to op- 
erate in. 

And this committee remained in close contact with the FAA and 
Boeing after the incidents occurred, and through final approval. 
The committee’s oversight activities — it was apparent that, 
throughout the process, that everybody was working towards a so- 
lution, and it did that. We greatly appreciate the Department of 
Transportation, Secretary LaHood and Deputy Secretary Porcari, 
Administrator Huerta, for personally meeting with me and others 
on the committee. 

And when new aircraft with novel use of technology can experi- 
ence issues, it is important that we address those issues early on 
in the process to make sure that we have safe aircraft. And this 
situation we were able to address. It does not mean they are un- 
safe. In fact, I believe they are safe today. 

The incidents — the FAA and Boeing’s responses to the incidents, 
we are going to remain looking at these, again, learning from the 
process, because I believe there are valuable lessons to be learned 
from this. And I look forward to hearing again today from our wit- 
nesses. And again, we will continue this oversight and we will con- 
tinue to closely monitor the FAA certification program. And, as the 
787 resumes normal operations, we will look again closely at what 
is going on, and what is transpiring. 

And, as I said, throughout this process I think everybody worked 
diligently, worked together to get the 787 back up in the air. That 
is positive for the U.S. economy, it is positive for the airlines, and 
the aviation industry in America. 

So, again, I would like to thank the chairman and the ranking 
member for holding this hearing today, and yield back. 

Mr. LoBiondo. ok, thank you, Mr. Shuster. Now we will turn 
to our first witness today, FAA Associate Administrator for Avia- 
tion Safety, Peggy Gilligan. Ms. Gilligan, you are recognized. 

TESTIMONY OF MARGARET M. GILLIGAN, ASSOCIATE ADMIN- 
ISTRATOR FOR AVIATION SAFETY, FEDERAL AVIATION AD- 
MINISTRATION 

Ms. Gilligan. Thank you. Chairman LoBiondo, Congressman 
Larsen, and members of the subcommittee, thank you for the op- 
portunity to appear before you today to discuss the certification of 
the Boeing 787. One of FAA’s central roles is to certify aircraft and 
components that are used in civil aviation operations. We have 
been doing this for more than 50 years. Right from the start, avia- 
tion products have often stretched the technological boundaries. 

Over the decades, we have enhanced our process and regulations. 
For example, for large aircraft like the 787, we have changed our 
regulations more than 130 times to keep pace with new ways of 
doing business and new technologies. For more than five decades, 
the FAA has compiled a proven track record of safely introducing 
new technology and new aircraft. 
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As we continue to certify new aircraft, I want to make one thing 
very clear. We take that responsibility very seriously. To certify the 
787, the FAA assembled a team of FAA 

Mr. LoBiondo. Excuse me. Could you pull the mic a little closer, 
please? 

Ms. Gilligan. Sure. Is that better? 

Mr. LoBiondo. Just pull it a little closer to you. Yes, that is 
good. 

Ms. Gilligan. OK. 

Mr. LoBiondo. Thanks. 

Ms. Gilligan. To certify the 787, the FAA assembled a team of 
FAA engineers, inspectors, test pilots, and scientists, as well as ex- 
perts from industry, think tanks, trade organizations, and other 
civil aviation authorities, in addition to all the expertise at Boeing. 
The certification of this aircraft took more than 8 years, hundreds 
of hours of FAA engineering review, and 900 hours of flight testing 
time. 

A key tenet of the certification process is to plan for the unex- 
pected, and this was the case in the 787. We required the manufac- 
turer to design systems to meet certain performance standards. 
Then we required them to assume a failure, and to design the air- 
craft so that it could be safely landed if a failure were to occur. 
Many layers of safety are built in to the meticulous processes and 
the thorough design. 

For the battery, for example, we established nine specific require- 
ments to protect against a battery failure, and to protect the air- 
craft if a battery should fail. One layer may fail, just as it did in 
the in-flight 787 battery incident. But the multiple safeguards built 
in, and the procedures pilots are trained to follow, enabled the pi- 
lots to safely land the aircraft. This is how the system works. 

Immediately after the 787 in-flight incident, the FAA issued an 
order that suspended flight to ensure that we had the time to con- 
sider the right solutions without compromising passenger safety. 
Our safety team worked thousands of hours alongside Boeing. And, 
as a result of the battery system review, Boeing made several 
changes. They redesigned the internal battery components to mini- 
mize a short circuit within the battery. They insulated the battery 
cells to prevent propagation from one cell to another. They added 
a robust battery containment and venting system to prevent a 
problem in the battery from spreading to the aircraft. Finally, the 
company improved the quality assurance process at the battery 
manufacturer, to ensure that the batteries meet our rigorous de- 
sign standards. 

We have concluded our review of the redesign, and we have ap- 
proved its operation. The aircraft is once again flying passengers 
safely around the world, and Boeing has resumed delivery of new 
787s. We are confident that the new design will protect the safety 
of the aircraft and its passengers. 

The FAA is continuing to review the critical systems of the 787, 
including its design, manufacture, and assembly. We began this 
broad review, which includes the FAA certification processes, in 
January, after the first incident. We expect to complete it this sum- 
mer. Both these actions, first addressing the immediate safety con- 
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cern, and then doing an indepth review of the product and the 
processes, are a standard way that we approach our safety mission. 

Some have asked whether the FAA has the expertise needed to 
oversee the 787’s cutting-edge technolo^. Not only does the FAA 
employ a staff highly experienced in aviation, but we have access 
to experts across the country and around the world. We establish 
rigorous safety standards, and make sure manufacturers dem- 
onstrate that the standards have been met. Our safety record 
shows just how successful we have been. 

What the 787 battery experience has shown is that neither the 
industry nor the FAA is perfect. But it also shows, as I noted ear- 
lier, that as aircraft are designed and built, we plan for the unex- 
pected, and we make appropriate data-driven decisions to manage 
risk to protect the safety of the flying public. 

As we have learned with the 787 certification, the way to en- 
hance safety is to keep lines of communication open between indus- 
try and Government, in order to foster the ability and willingness 
to share information about the challenges that we all face. These 
solutions show the FAA and its industry partners continue to cre- 
ate an atmosphere where people work together, all in the pursuit 
of maintaining the highest levels of safety. That is why we are all 
here. 

The FAA will never lose sight of the respective roles. But there 
is always a seat at the table for the bright minds from industry to 
help inform the best way to navigate the complex technological 
issues we encounter. It would be shortsighted to overlook anyone’s 
valuable expertise. 

Mr. Chairman, I am proud of the safety record we have achieved, 
and I am confident we have the best people in the right places to 
meet our challenges ahead. 

That concludes my testimony, and I will be happy to answer any 
questions you may have. 

Mr. LoBiondo. Thank you very much. A couple of questions that 
I have. During the two battery incidents, was the safety of the air- 
craft or the flying public ever in danger? 

Ms. Gilligan. The first incident, as you are aware, occurred on 
the ground after the flight had been completed. All the passengers 
and crew had left the aircraft, and the aircraft was being cleaned. 
So, in that particular incident, there was no risk to anyone during 
the operation. 

In the second incident, which did occur in flight, so far we believe 
that after the battery event itself, the remainder of the system op- 
erated in accordance with the standards. That is, it contained the 
event within the battery. We still do not have the root cause anal- 
ysis completed by the NTSB, so that we do need to wait and see 
what the final results of that investigation are, to see if there was 
any additional risk that we haven’t identified yet. 

Mr. LoBiondo. Do you believe the FAA certification processes in 
place were sufficient to address and remedy the concerns raised by 
these incidents? Or should we relook at that somehow? 

Ms. Gilligan. We believe that the certification process is really 
quite robust. I think the safety of the system indicates that the 
products that FAA and others around the world have certified do 
provide an appropriate level of safety. 
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Having said that, we always are looking to improve the proc- 
esses. We have learned some lessons from what we have seen al- 
ready with these two events. We will learn more lessons from the 
NTSB review, as well as our own indepth review. All of that infor- 
mation will be rolled back into the certification process to improve 
upon a very sound, robust basis. 

Mr. LoBiondo. Understanding that we don’t have the NTSB 
final report, what do you think the lessons learned from these two 
incidents are up to this point? And what is the FAA doing in re- 
sponse to lessons learned? 

Ms. Gilligan. I think we have seen a couple of important les- 
sons. The first is that we now have a much more robust process 
for testing lithium ion batteries, if they are used in aviation. The 
certification standards and the testing that Boeing demonstrated in 
the redesign will become the standard the FAA and other authori- 
ties around the world will use when we evaluate the level of safety 
provided by a lithium ion battery used in an aircraft. So that is a 
very important lesson, and that is already in place. 

I think, in addition, we have seen some areas where we can im- 
prove our process. One thing we realized is that some of these new 
technologies are not just used in aviation. There can be a commu- 
nity of experts who know something about the technology, but have 
nothing to do with aviation. We want to be able to reach that com- 
munity. In this case, Boeing brought together a number of experts 
on lithium batteries, and we learned a great deal from them. 

So, what we need to do is broaden how we reach out for com- 
ments on our standards and expert review, to make sure that, if 
there is a community of experts outside of aviation, we know how 
to reach them. 

We are also looking at some of the process improvements inter- 
nally that address new technologies. We are thinking that it prob- 
ably makes sense to have people who are not involved in that par- 
ticular certification to periodically review our work and the manu- 
facturer’s work to make sure the FAA folks involved in the certifi- 
cation aren’t overlooking something, or that we haven’t missed an 
assumption, or that we haven’t asked a critical question. 

So, those are the kinds of process improvements that we are al- 
ready seeing would add value to our certification process. 

Mr. LoBiondo. Thank you. Mr. Larsen? 

Mr. Larsen. Thank you, Mr. Chairman. Ms. Gilligan — was this 
last month — we had Mr. Huerta in front of us, and he said that 
FAA had announced a review of the certification process related to 
the 787, and that review is ongoing, and so on. Specifically, you 
have outlined some lessons learned, but can you give us a timeline 
on when that review of the certification process will be done? 

Ms. Gilligan. Sure. 

Mr. Larsen. Can you, as well, focus — help us understand what 
the focus is of this particular certification review? 

Ms. Gilligan. Sure, I will be glad to. After the first incident that 
occurred in Boston, the Administrator and Secretary, along with 
Boeing executives, announced that we were going to undertake this 
indepth review. With the second incident, and then the airworthi- 
ness directive, we lost a little time doing the indepth review be- 
cause a lot of the same folks needed to be included in the ongoing 
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initiatives. So we actually kicked the indepth review off in early 
February, and the group has been working pretty much full-time 
since then, with an eye toward completing their review in the sum- 
mer. 

So, what that team did, was go beyond information on the bat- 
tery to look at all of the operational data that we had from the air- 
craft since its introduction into service. We wanted to see if there 
was any trend, any set of incidents that needed to be looked at 
more thoroughly. We have identified a couple of areas and are 
doing what we call deeper dives into those areas to see what it 
shows us. From that, we expect to make some findings and rec- 
ommendations on process improvements and perhaps other actions 
that we or Boeing or both will need to implement. 

Mr. Larsen. I think we will — well, at least I will look forward 
to seeing the results of that review and getting briefed on those. 
Since you are in that process, I won’t go into too much detail with 
you right now. 

But a question about — that arise out of this incident isn’t a new 
question, but I wanted to give you an opportunity to address it. It 
has to do with this term people — some folks have used in the media 
called self-certification, that this is one of the dangers of self-certifi- 
cation. Can you help us understand why FAA would argue that 
this is not self-certification? 

And let me give you a — self-certification would be Company A 
goes and does what it does, and comes back to you, and you check 
the boxes. 

Ms. Gilligan. Right. 

Mr. Larsen. Versus FAA does everything and then hands it to 
the company and says — you know, to Company A, and says, “Do 
this.” 

So, those are the goal posts — I am sorry, the bookends; I got my 
analogies wrong. Those are the bookends. How do you characterize 
the certification process? 

Ms. Gilligan. We would agree that the term “self-certification” 
is a misnomer, because Boeing doesn’t certify anything. The Boeing 
Company, as the manufacturer, is responsible for demonstrating 
that their product meets all the standards that we have set. They 
have to have data and information and analysis that shows that 
they have met those standards. Then the FAA, or someone who 
works on our behalf 

Mr. Larsen. And, I am sorry, this would apply to someone who 
makes a vortex generator this big and someone who makes an en- 
gine for an airplane, as well. 

Ms. Gilligan. Yes. 

Mr. Larsen. This applies to anybody looking to build a part for 
an airplane here in the U.S. 

Ms. Gilligan. Right. The certification process is fundamentally 
the same. 

Mr. Larsen. Right. 

Ms. Gilligan. There are some small parts that are treated very 
differently, but you are right, the major systems or parts of aircraft 
go through the certification process. 

It might be easiest if I can describe it through an analogy. We 
see it like taking a test. FAA is the one who sets the criteria for 
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passing the test. We tell the student, the applicant, in this case the 
manufacturer, what it takes for them to pass the test. They have 
to take the test and pass it. Then we, or people on our behalf, 
grade the test and determine if they passed. That is really how it 
works. 

The FAA and our designees, who we appoint based on the au- 
thorization provided by Congress for the Administrator to appoint 
people to act on his behalf, are the ones who make the determina- 
tion that the standards have been met. 

Mr. Larsen. Let’s 

Ms. Gilligan. Does that help? 

Mr. Larsen. Let’s beat this dead horse a little bit, the analogy 
about the tests in school, because on page 5 of your testimony you 
discuss the lithium battery literature. So part of what you did, 
then, was to review the available lithium battery literature, include 
a consideration of the hazards of other battery technologies such as 
nickel cadmium and, presumably, lead acid batteries, as well. But 
the end result is that then you created a test for these special con- 
ditions, but the test itself perhaps was bad. 

Ms. Gilligan. We haven’t seen the data that says that the 
standard that we set was bad. In fact, if you compare the special 
condition to the regulation that was on the books for batteries, you 
will see that we made it much more robust. Lithium batteries pro- 
vide higher energy at lighter weight. 

Mr. Larsen. Sure. 

Ms. Gilligan. That is why manufacturers wanted to use them. 
But because of that higher energy, they also pose a different kind 
of risk than other batteries. That is why the standards we had in 
place didn’t fully address the risks that lithium ion batteries could 
introduce, and that is why we added additional requirements. We 
even made some of the original requirements more robust, for the 
purpose of the manufacturers showing that the lithium battery was 
sufficiently safe for this application. 

Mr. Larsen. The conditions state that lithium ion batteries are 
significantly more susceptible to internal failures that can result in 
self-sustained increases in temperature and pressure than their 
lead acid counterparts. Did those hazards cited in the special condi- 
tion trigger a heightened level of FAA involvement in the certifi- 
cation or compliance activities for the battery, based on that risk 
analysis? 

And can you explain any additional actions FAA took? 

Ms. Gilligan. We set the new standard, in consultation with the 
manufacturer and the industry. We put that standard out for com- 
ment. We received some comments, again, from people in the avia- 
tion industry. This, again, is where I think we saw a lesson 
learned. We need to make sure that that kind of special condition 
also went to experts on lithium ion batteries, who might have been 
able to help us understand better how to improve it. So that is 
something we will look at changing in the future. 

Then it was for Boeing, in accordance with the certification plan 
that we approved, to do tests and analysis to show that they had 
met all the requirements of the special condition. We had designees 
on our behalf who made the finding that Boeing had shown that 
they met those standards. 
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Mr. Larsen. What is a designee on your behalf? Is that an FAA 
employee? 

Ms. Gilligan. No. Again, under our statute, we have been au- 
thorized for many years to have the Administrator appoint individ- 
uals or organizations to perform some functions on our behalf. We 
have a program at FAA where our engineers, in this case, oversee 
the performance of the individual who is designated, or the organi- 
zation who we have given a designation to, to make sure that they 
are properly performing their functions, that they are making the 
same findings the FAA engineer would have made, if they had 
done it themselves. 

It is a way that we can leverage our resources, because there are 
a large number of approvals that are required in a manufacturing 
program and in our operational environment, as well. A cadre of 
FAA employees would be extremely large, probably unmanageably 
large. So we leverage our engineering expertise through the des- 
ignation of individuals and organizations to act on behalf of the Ad- 
ministrator, in accordance with the FAA Authorization Act. 

Mr. Larsen. The designee program has been around since 1938? 

Ms. Gilligan. The designee program has been around since the 
late 1930s. I think it was a very elegant solution that the Congress 
came to, realizing that there would be a number of these repetitive 
approvals that we would need, so that the public saw that aviation 
was safe, but there would never really be a Federal cadre of em- 
ployees who would be sufficient to carry that out. 

So, we have been able to leverage FAA resources by appointing 
individuals to act on our behalf. It is considered quite an honor to 
be an FAA designee. It is taken quite seriously. We continue to 
oversee that those individuals, or the organization that holds that 
approval, to ensure they are performing properly. We have the abil- 
ity to withdraw the designation if they are not. So we manage it 
in that way. 

Mr. Larsen. I have further questions, but I will take a second 
round. Thank you. 

Mr. LoBiondo. Mr. Meadows? 

Mr. Meadows. Thank you, Mr. Chairman, and thank you, Ms. 
Gilligan, for being here and, obviously, being well-informed on the 
process. And I just compliment you on that. 

It is my understanding that when the NTSB gets involved in in- 
vestigation, that all the parties with the investigation are severely 
limited in their ability to respond or communicate, either to the 
public or the media. And they are even restricted, at times, in their 
communication between the parties. For example, between the FAA 
and Boeing, or between Boeing and Japan Airlines. And these com- 
munications first have to go through the NTSB for clearance. 

Specifically, are there any reforms that you could see that the 
FAA or the NTSB could make that would allow this process to 
work more effectively, in terms of investigating incidences, while 
still allowing them to respond to the public and to each other? 

Ms. Gilligan. Well, sir, I think the party system, which the 
NTSB uses, does allow for all of the interested organizations that 
are involved to have a forum to make sure that they are sharing 
information about the particular event or incident or accident. 
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In this day and age, with the instant demand by media and oth- 
ers for immediate information, it is sometimes difficult to make 
sure that things that are unique to the accident or incident being 
investigated don’t get into the public domain before the organiza- 
tion responsible for that investigation has an opportunity to con- 
sider how it should be presented. 

I do think, in all the cases that I am aware of, we are able to 
work out the needed exchange of information so that the NTSB is 
confident that they are controlling the information about the acci- 
dent itself. While, meanwhile, as you point out, we and manufac- 
turers and others, we have other safety information that we need 
to share to make sure 

Mr. Meadows. But — excuse me — you hit two key points, though. 
You keep referring to accidents, and this wasn’t an accident. It was 
an incident. And there is a big difference there, because — I think 
of this as a compliment to the FAA and to Boeing and to a number 
of the situations, because it wasn’t an accident, it was something 
that got identified as an issue. 

And I guess, you know, when we had previous testimony with 
the FAA, it is — the Administrator said, “Well, Boeing is taking re- 
sponsibility, but we know that there was a number of other issues 
that weren’t specifically related just to Boeing, and yet that infor- 
mation never got out.” So, you know, it is not an accident, it is an 
incident. 

So are there any reforms that you would recommend to the proc- 
ess right now? 

Ms. Gilligan. I think we have a very good working relationship 
with the National Transportation Safety Board. If we are ever in 
need of safety information, and there is any question as to whether 
or not we can receive it, those questions are very quickly cleared 
up. I know we have also worked with the NTSB and Boeing and 
others involved in these investigations to make 

Mr. Meadows. So there are no reforms that you would rec- 
ommend. 

Ms. Gilligan. I don’t know of one, offhand, sir. 

Mr. Meadows. OK. 

Ms. Gilligan. I honestly don’t. 

Mr. Meadows. Well, then, let me ask you a different question, 
then. When they get involved, when the NTSB gets involved, how 
does that affect your ability to investigate, or does it change at all? 
If they are involved or if they are not involved, does your process 
change at all? 

Ms. Gilligan. There are two parallel tracks. We support the 
NTSB. In fact, many of our technical experts provide their tech- 
nical expertise to the NTSB. As you know 

Mr. Meadows. Right. 

Ms. Gilligan [continuing]. NTSB is a small organization. They 
certainly don’t have depth of expertise in all of the areas of avia- 
tion. So we provide technical expertise, as do other parties, to those 
events, those investigations. 

Mr. Meadows. So does it limit your ability to investigate at all? 

Ms. Gilligan. No. On a parallel track, we have other inde- 
pendent responsibilities, because of our authorization 

Mr. Meadows. Right. 
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Ms. Gilligan [continuing]. To make sure that we are under- 
standing if there are any immediate safety-of-flight issues, or 
things that go heyond what may be the probable cause of that acci- 
dent. We very much try to separate that out, and we do our review 
to see if there are safety improvements we need to make while they 
do their investigation. 

Mr. Meadows. OK. My time is running out. So let me ask you. 
If you had legislation coming from this committee that said that we 
would allow for a little bit more public disclosure on incidences, 
and maybe keep that limited — public domain on accidents, is that 
something that the FAA could support, if you had legislation com- 
ing from this body? 

Ms. Gilligan. We 

Mr. Meadows. Is that something you would welcome? 

Ms. Gilligan. We certainly could follow whatever direction along 
those lines that might come through legislation. I think 

Mr. Meadows. But would you welcome that? 

Ms. Gilligan. Sir, we would really have to see what the lan- 
guage is. But I understand your point. I do think that incident re- 
view needs to be an open exchange of information by all of the safe- 
ty professionals, so that we can be sure we are going to prevent 
something that could be prevented. We understand what happened. 
And anything that would support that, we could support. 

Mr. Meadows. I yield back. Thank you, Mr. Chairman. 

Mr. LoBiondo. Thank you. Mr. Williams. 

Mr. Williams. Yes. I want to say thank you for being here, Ms. 
Gilligan, we appreciate it. 

First of all, I am going to ask you an important question. Would 
you feel comfortable flying on a Boeing 787? 

Ms. Gilligan. Yes, sir. 

Mr. Williams. OK. Are you doing anything to change the skill 
set of your workforce in aircraft certification to move to a more 
risk-based system approach to safety oversight? 

Ms. Gilligan. Yes, sir, we are. We do see that the level of safety 
in the system now is at an all-time high. The only way we are 
going to continue to build on that is to make sure that we have, 
and are analyzing, what is occurring; that we are finding things be- 
fore they cause catastrophic failure, and we are able to fix it. So 
we are moving toward that kind of approach. We identify risks, 
identify what we can do to mitigate, manage, or eliminate those 
risks, and oversee that implementation to make sure the mitigation 
has been effective. 

That will add to the skill set of our workforce, but on the certifi- 
cation side we will always need, obviously, aerospace engineers and 
other kinds of engineering expertise. We are looking for a cadre of 
folks who have that engineering expertise, and also the ability to 
do data analysis to really inform how they make their engineering 
decisions. 

Mr. Williams. One other question, which you basically touched 
on just a second ago. But, simply put, do you believe that Congress 
needs to take additional actions as a result of this — of the battery 
incidents? Do we need to get more involved? 

Ms. Gilligan. No, sir. I believe, as both the chairman and Con- 
gressman Larsen pointed out, we believe that this is a demonstra- 
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tion of the system really working well. The reality is these are com- 
plex pieces of equipment, and things will go wrong. But we need 
to make sure the airplane can land safely, and that is what we did. 

Mr. Williams. Less Government is the best Government. Thank 
you for being here. 

Ms. Gilligan. Thank you, sir. 

Mr. Williams. I yield back. 

Mr. LoBiondo. Mr. Larsen? 

Mr. Larsen. Ms. Gilligan, could you compare the level of involve- 
ment in the certification activities associated with the redesign of 
the battery with the certification of the original design, and explain 
what, if any, actions, as well as direct involvement, the FAA took? 

Ms. Gilligan. Sure. I think it is important to realize that after 
the second event, the in-flight event, we determined that we had 
an unsafe condition. That always drives a higher level of FAA in- 
volvement. So we worked very closely with Boeing for thousands of 
hours to understand what were the risks. Boeing did a very in- 
depth analysis, brought together a team of experts on lithium ion 
batteries to understand, since we didn’t know the root cause of the 
two events, we needed to understand what was the group of things 
that might have resulted in either one of those events occurring. 

So, Boeing identified those areas. That led to what design 
changes needed to be made to address those risks, and the evalua- 
tion and testing to demonstrate that those designs would be effec- 
tive. We were with them pretty much every step of the way. 

There was a list of about 20 tests that needed to be performed. 
We, FAA employees, witnessed most of those tests on this redesign. 
Because, again, we were dealing with an unsafe condition, and we 
really needed to get to the root of that to be able to solve the prob- 
lem. 

Mr. Larsen. So then — so you have characterized how the FAA 
was involved. Can you characterize the — I don’t know, the amount 
of time directly involved? 

Ms. Gilligan. We have some hour counts, and I hesitate to use 
them. So we have estimated about 7,000 hours. But it is important 
to understand for the work on the airworthiness directive 

Mr. Larsen. Right. 

Ms. Gilligan [continuing]. We also collect a lot of our overhead 
kinds of time. A lot of our executives and senior managers were in- 
volved in the work on the AD. Their time is included in that num- 
ber. In a standard certification, the manager time isn’t always ac- 
counted for in the same way. But with that exception, we spent 
thousands of hours working with Boeing. 

Mr. Larsen. What does this — what does the certification proc- 
ess — FAA’s involvement in the certification process of the redesign 
tell you about your future involvement in the certification of the 
use of lithium ion batteries in — you know, in the next airplane, 
whoever makes it? 

Ms. Gilligan. Well, again, we will use the same kind of en- 
hanced testing and analysis, because we have seen how that can 
really show what will happen to the battery, and whether or not 
the design really meets our standards. 

Whether or not we would delegate, or ask our designees to make 
the findings of compliance will very much depend on the expertise 
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of the applicant, the expertise of the designated organization or the 
individuals in that company. It is always kind of a case-by-case de- 
termination. But I think we will continue to keep our eye on appli- 
cations for the use of lithium batteries to be sure that the testing 
and the standards are as robust as they need to be. 

Mr. Larsen. Have you changed the literature review, literally? 
It might sound like a snarky question. But if the first lit review 
of lithium ion batteries did not indicate to you, or — as the FAA, of 
a testing regimen that would result in the similar incident that we 
saw with JAL or ANA, has the body of literature changed? 

Ms. Gilligan. Well, again, I think, from the expert panel that 
Boeing put together, we did learn that, in the intervening years, 
more has been learned about lithium ion batteries and their risks 
and how to test for those. 

I do think it is important to note, and I am sure that Mr. Sinnett 
will, in the next panel, that in order for Boeing to reproduce the 
events that occurred in the two incidents 

Mr. Larsen. Right. 

Ms. Gilligan [continuing]. It was an extremely difficult test. It 
really pushed the battery much, much further than anybody real- 
ized it would need to be pushed, if that is the right way to de- 
scribe — 

Mr. Larsen. Sure, I understand. 

Ms. Gilligan [continuing]. In order to replicate what occurred in 
the two incident batteries. 

So, I do think we have a very robust set of tests now that we 
are confident reflect the best knowledge on lithium ion batteries 
today, and we will continue to evaluate that testing. We have the 
RTCA right now, a standards organization that helps us set stand- 
ards — 

Mr. Larsen. Yes. 

Ms. Gilligan [continuing]. Working on testing standards for 
small and medium-sized lithium batteries. We will task them to go 
back and continue to review the application of large lithium ion 
batteries, to make sure, if there are changes in that literature, that 
we are on top of it and we are able to incorporate changes if we 
need to. 

Mr. Larsen. Didn’t the RTCA’s standards for testing lithium ion 
batteries change in the 2008 timeframe? 

Ms. Gilligan. That was the first time they issued standards on 
our behalf. You know 

Mr. Larsen. Yes. Were the 

Ms. Gilligan [continuing]. They provided standards 

Mr. Larsen. Were those standards different than what was — 
the — were they different than what the lithium ion batteries were 
then being tested under? 

Ms. Gilligan. They were different than how Boeing dem- 
onstrated compliance with our original set of standards, because 
they had a standard that would have allowed for the battery to be 
recharged. In the Boeing design, Boeing had determined that they 
would not permit the battery to be recharged. So that was not a 
standard that needed to apply. 

There may have been other differences, but I don’t think we con- 
sidered them substantial. 
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Mr. Larsen. Yes. And who participated in the RTCA panel to 
look at that? 

Ms. Gilligan. Oh, RTCA is a way that we bring together a large 
number of experts. 

Mr. Larsen. Right. 

Ms. Gilligan. It was quite a large panel, as I recall. We have 
got the list of people and organizations, but they were 

Mr. Larsen. Were you — was the FAA involved? 

Ms. Gilligan. Oh, yes. 

Mr. Larsen. Directly in that? 

Ms. Gilligan. Yes. RTCA takes these assignments from FAA. 
We ask 

Mr. Larsen. Well, I know they take the assignments from you. 

Ms. Gilligan. Oh. 

Mr. Larsen. But was 

Ms. Gilligan. But yes, yes. 

Mr. Larsen. The FAA’s folks were there? 

Ms. Gilligan. Yes, we had somewhere between 5 and 10 partici- 
pants in the course of the development of the standards, both to 
help inform the other experts about how FAA uses standards as 
well as to make sure we had a group of people who really under- 
stood the standard when we received it. 

Mr. Larsen. So, then, was the lithium ion battery standard that 
came out in 2008 from RTCA, their recommendations from RTCA, 
were those incorporated in testing and retesting lithium ion bat- 
teries for use in large airplanes? 

Ms. Gilligan. The standards really provide a manufacturer with 
a method of how to go about showing compliance to the perform- 
ance standards that we set. 

Mr. Larsen. Right. 

Ms. Gilligan. So, we did not require anyone who already had an 
approved lithium battery application to go back and retest using 
the RTCA methodologies. 

Mr. Larsen. And why not? 

Ms. Gilligan. Well, we had developed the special conditions in 
accordance with our counterparts in Europe. Airbus A380 was 
using some small lithium batteries. So we had already all agreed 
on what that standard was. Boeing had, at that time, provided suf- 
ficient data to demonstrate compliance with those standards. So, 
there was no 

Mr. Larsen. With the new standard? 

Ms. Gilligan. No, with the standards that we applied. In air- 
craft design it is vep^ difficult to go back and cause existing prod- 
ucts to be retested in accordance with some new standard or new 
information that we may get, unless something in the new informa- 
tion suggests that there is an unsafe condition in the old, existing 
product. 

Mr. Larsen. And, if I may, and you are arguing that there was 
nothing in the newer standards that indicated there was something 
unsafe in the 

Ms. Gilligan. That is correct. 

Mr. Larsen [continuing]. In the existing standard? 

Ms. Gilligan. That is correct. 

Mr. Larsen. Yes. Thank you. 
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Mr. LoBiondo. Mr. Radel? 

Mr. Radel. Thank you, Mr. Chair. Appreciate it. Thank you so 
much for your time. I had two questions. The first — sorry, I had to 
step out for a second — apparently, the first was already covered. It 
is in reference to the organization designation authorization. And 
I hope that we can work together really to make sure that this per- 
mitting process of these regulations that at times are incredibly 
burdensome for the industry, that we can work together to make 
them more efficient, streamline them. Because at the end of the 
day, a lot of these costs for the entire industry, they have to get 
passed along to us, who want to buy plane tickets. 

The other thing I just wanted to touch upon was budgeting. We 
know how sequestration has been difficult, to say the least, for the 
FAA, especially when it come to prioritizing. I would ask you what 
guidance can our committee here give the FAA in the future for fu- 
ture reauthorizations to better facilitate prioritization of funding, 
as our Republican House continues to enact cost savings on behalf 
of our American taxpayer? 

Second part, what specific spending latitude will ensure that the 
FAA continues to meet its duties of oversight and efficiency for air- 
plane manufacturers? 

Ms. Gilligan. Well, if I could start with the second one first 

Mr. Radel. Sure. 

Ms. Gilligan. Excuse me. First, I think we are very appreciative 
of the work that Congress did to allow the Administrator the flexi- 
bility to move some funding within our different accounts at the 
FAA, so that we could avoid furloughs this year. I think the idea 
of losing 10 percent of everyone’s work time would have had a tre- 
mendously negative impact on some of the certification projects 
that we have underway. 

At the same time, we still are looking to save over $380 million 
at the FAA. And that, obviously, will have its impact as well. Right 
now we are in a hard hiring freeze, for example. We see pockets 
where people have left, resigned, retired, whatever, and it is having 
a harder impact in some small offices. 

As to how to help us set our priorities, I do think the last reau- 
thorization was very helpful. It provided a number of opportunities 
for us to work with our industry to review our certification proc- 
esses, to try to find what it is that causes it to be burdensome, or 
to determine where there may be inconsistent outcomes among dif- 
ferent offices. That will provide us a real opportunity to work with 
industry to try to improve those areas. 

Hopefully you will see some results from that review, and that 
might well inform additional authorizations that would be useful, 
going forward. 

Mr. Radel. All right. Again, thank you so much for your time. 
I yield my time. 

Mr. LoBiondo. Ms. Johnson. 

Ms. Johnson. Thank you very much. Let me apologize for being 
a little late; had to go to another committee. And I hope you 
haven’t answered these questions. But what I would like to know 
is what key lessons have you learned with regard to this January 
Japanese Airlines incident. And will you summarize the process 
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that FAA uses to create special conditions for new technologies? 
And why are special conditions necessary? 

Ms. Gilligan. Sure. If I may, I will start with the second one 
first. The special conditions is a tool that we have to allow the in- 
troduction of new technologies, most of which enhance safety, be- 
fore we have had an opportunity to go through an extended rule- 
making process. So, special conditions and, in this particular case, 
the special conditions related to lithium ion batteries built off 
standards that we had always had in place for traditional batteries. 
The special condition specifically identified the higher risks that 
are posed by lithium ion batteries, and provided for a more robust 
demonstration of protection from those risks. 

Special conditions are really a way of building off what we know 
to allow the introduction of new technology carefully, making sure 
that we set a little bit more robust standard for something that is 
new, or novel, before we just allow it into the aviation system. 

As to lessons learned, I had mentioned before we are still waiting 
for the NTSB’s final investigation report on probable cause, and we 
think that will help inform some lessons. FAA and Boeing are also 
doing an indepth review of the certification process, and we expect 
to learn lessons from that, as well. 

But there are some things that we have seen already. I think the 
first and most important is that we have identified a more robust 
testing regime to be used for testing lithium ion batteries. Boeing 
used that in the redesign, and that will be the regime that FAA 
will use, going forward. So I think that is an important lesson. We 
have already raised the safety bar that much. 

In addition, we have identified that with new technologies there 
often times are experts who are not involved in aviation, but are 
experts in that technology. We need to find a way to make sure we 
are reaching that community of experts to help us make sure that 
when we introduce new technologies, we understand everything 
that can be known at the time. 

So, those, I think, are a couple of lessons learned. There are also 
those kinds of process improvements, where we need to enhance 
communication between the manufacturer and all of the sub-tier 
providers that they buy parts from. FAA needs to be monitoring 
that more closely, as well. So there are several process improve- 
ments that we are going to pursue, as well. 

Ms. Johnson. Thank you. In your written testimony you discuss 
the use of aviation experts outside the agency to resolve technical 
problems, noting certification of aviation products and systems is 
not limited to the participation of a single certifying entity and 
manufacturer. Please explain what steps, if any, the FAA takes to 
bring this independent, outside technical expertise to bear on the 
challenges associated with the certifying of the lithium batteries for 
the use of Boeing 787. 

Ms. Gilligan. Yes, ma’am. As we were just talking, there is an 
organization called RTCA, which is a standards-setting organiza- 
tion that FAA uses, along with SAE, another similar organization. 
Through those groups, we pull together experts on the technology. 
So, again, at the RTCA we had a wide-ranging panel of experts 
with aviation experience, with lithium battery experience, to help 
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us build the standards and the description for how a manufacturer 
would demonstrate that the lithium ion battery was safe. 

We do have a lot of mechanisms in place that let us reach ex- 
perts around the world on the particular technologies that we are 
trying to address. 

Ms. Johnson. Thank you very much. Thank you, Mr. Chairman. 

Mr. LoBiondo. Mr. Davis. 

Mr. Davis. Thank you, Mr. Chairman, and thank you, Ms. 
Gilligan, for being here today. I apologize for coming in late. That 
seems to be the nature of our business, they double-book things. 

But I know you mentioned you had some responses to organiza- 
tion designation authorization. I would just like to ask you quickly 
a couple questions to have you expand on that. With fewer re- 
sources on the horizon for FAA across all offices, how will you fur- 
ther utilize ODA and that delegation to meet the growing certifi- 
cation workload for new products at both Boeing and throughout 
the American aerospace industrial base? 

Ms. Gilligan. Thank you, sir. As we discussed a little bit before, 
FAA has, for many, many years leveraged our internal resources 
by using either individuals or, now, organizations to whom we dele- 
gate authority to act on our behalf It is a key way that we are 
meeting the safety requirements for certifying products. We see 
that expanding over time. 

The ODA is a relatively new authorization. We are learning, as 
the industry applicants are learning, as we go. But I expect that 
we will see ODA, if not mushroom, certainly grow substantially. It 
is a way that we can leverage our resources and assure the safety 
of the product at the same time. 

Mr. Davis. OK, thank you. Now, Boeing. Right now are you over- 
seeing all of the — are you overseeing the entirety for inspections 
that would normally fall under an ODA 

Ms. Gilligan. Oh, no. 

Mr. Davis [continuing]. Or their employees? 

Ms. Gilligan. Oh, no, no. The Boeing Company has an ODA. It 
is quite a robust ODA. We work very closely with them. We con- 
tinue to provide oversight of the ODA. We need to assure that they 
are performing their authorizations on our behalf appropriately. I 
think, as we see in this hearing, there is always a balance between 
how much we delegate and how much involvement the FAA has. 
It is a delicate balance that we watch closely. Mostly, what we 
want to assure is that those who are operating or acting on behalf 
of the Administrator, do so in the same way an FAA engineer 
would have operated. We see that that is very much the case at 
the Boeing ODA. 

Mr. Davis. OK. So Boeing is still completing some delegated 
tasks that they have normally completed, and you are just doing 
your oversight? 

Ms. Gilligan. That is right. We provide oversight of the ODA. 

Mr. Davis. All right. I yield back the balance of my time. Thank 
you for your time today. 

Ms. Gilligan. Thank you. 

Mr. LoBiondo. Mr. Duncan? 
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Mr. Duncan. Well, thank you, Mr. Chairman. Like the others, I 
had another hearing that started at 9:30 before this one. But — so 
I don’t know if this has heen covered, or not. 

But the next witness is going to testify that Boeing put this — 
these — this 787 electrical system under an astounding amount of 
testing, 5,000 hours of component testing, 25,000 hours of labora- 
tory testing, 10,000 hours at the airplane level, simulation of 100 — 
equivalent to 132,000 flights. In the FAA study of this, have you 
been able to determine why, after all this testing, did this problem 
not show up before? Is it just a fluke, or 

Ms. Gilligan. Mr. Duncan, again, we haven’t seen the root cause 
analysis or the probable cause determination for the two individual 
incidents from the NTSB. We agree with Boeing that, with all the 
testing that was done for the original certification, we did not see 
these types of events manifest themselves. We also know that when 
we introduce new products, after all of the engineering work that 
has been done, we often see something in operation that either we 
did not anticipate during certification, or where we see one of the 
assumptions that we built off of was just not accurate. 

So, it is not uncommon for us to learn from the new product after 
it is introduced and to make improvements. That is what happened 
here. We had two events, we went back and analyzed them. Boeing 
redesigned the system, we were able to approve that redesign. The 
system and the aircraft are safer for it. 

Mr. Duncan. And I assume it is just a coincidence that both of 
these carriers happen to be Japanese carriers, as I understand. But 
is there something that these carriers require, or that the Japanese 
Government requires, that is different from what went into the 
other 787s? 

Ms. Gilligan. No, sir, not that I am aware of. Right now, we 
really are looking at the aircraft, the design manufacture and as- 
sembly of the aircraft, to see if there is anything that we may have 
overlooked that might have contributed to these two events, and, 
if so, we will address those based on whatever the data shows. 

Mr. Duncan. The FAA requires manufacturers to assume or pre- 
pare for problems occurring, and this — and have a plan for mitiga- 
tion to take care of these types of situations. And apparently, you 
didn’t find that this plane was at risk at any time, and no one was 
injured. So, from that standpoint, the system worked. Would that 
be a correct statement? 

Ms. Gilligan. Yes, sir. Until we see what the probable cause 
was, it does appear that, although we had the failure within the 
battery at the cell level, that the rest of the design, which met our 
standards, did contain that event, thus the aircraft was not at risk 
and was able to safely land. 

You are right, that is very much a tenet of our certification proc- 
ess, to design so there won’t be a failure, then assume there is a 
failure and design so that the airplane can safely land. In that re- 
gard, after the event occurred, it appears everything worked as it 
was intended to work. But again, we will need to see what the 
NTSB results show. 

Mr. Duncan. All right. Thank you very much. 

Mr. LoBiondo. ok, Ms. Gilligan, we thank you very much, ap- 
preciate it, and we will move on to the second panel. Mike? 
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Ms. Gilligan. Thank you, sir. 

Mr. LoBiondo. ok. Our second witness today is Mike Sinnett, 
Boeing’s chief engineer for the 787 program. Mr. Sinnett, you are 
recognized for a statement. 

TESTIMONY OF MIKE SINNETT, VICE PRESIDENT AND CHIEF 

PROJECT ENGINEER FOR THE 787 PROGRAM, THE BOEING 

COMPANY 

Mr. Sinnett. Chairman LoBiondo, Ranking Member Larsen, 
members of the committee, my name is Mike Sinnett, and I am the 
vice president and chief project engineer for the Boeing 787 pro- 
gram. It is my pleasure to appear before you today, and I want you 
to know that Boeing is committed to supporting your work in any 
way that we can. 

Mr. Chairman, Boeing’s highest priority is the safety of the pas- 
sengers and crews who fly on our airplanes. Every Boeing airplane 
incorporates the broad, deep, and ever-increasing knowledge we 
have gained from nearly 100 years of designing and building air- 
planes. Our design approach is data-driven, with risk carefully as- 
sessed and managed. Our designs feature multiple layers of protec- 
tion and redundancy of critical systems, so that no single compo- 
nent failure or combination of failures, even extremely remote, can 
endanger an airplane. 

Mr. Chairman, flying is as safe as it is because industry and 
Government work together day in and day out. The 787 illustrates 
that commitment to cooperation. The design process started with a 
review of everything the industry and its regulators have learned 
about designing, building, and operating safe airplanes. I can attest 
to the team’s strong focus on safety, and to the strength of the cer- 
tification process, which was more rigorous for the 787 than it was 
for any of our previous airplane programs. 

When our airplanes enter service, we continuously monitor their 
performance, analyze the data we collect, share safety-related find- 
ings with customers and regulatory authorities, and work with all 
parties to incorporate lessons learned into the active fleet and its 
new production and designs. The result is an exceptional, safe, and 
reliable airplane. 

Over its first 15 months of service, the 787 achieved a schedule 
reliability rate of 98.2 percent. That is better than the 777, which 
had been considered the best in its class up to that point. At the 
end of that 15-month period, we experienced two battery failures. 
And as we explained at recent NTSB hearings, both incidents, 
while serious, demonstrated the effectiveness of our design philos- 
ophy. The airplane’s redundant safety features worked. They pre- 
vented the incidents from jeopardizing the passengers and crews. 

With that said, the work done following the two incidents re- 
vealed ways we could improve the battery system even further. 
Boeing devoted more than 200,000 engineering hours to develop a 
comprehensive solution, and worked closely with the FAA to test 
and certify these improvements. Through changes to the design of 
the battery, the manufacturing process, and the addition of a steel 
enclosure, we added protections that reduced the likelihood of a 
failure, and further ensured that, should a failure occur, there will 
be no significant impact to the airplane. 
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Mr. Chairman, I would like to turn to certification, because I 
know that is a subject of great interest today. All of our airplanes 
are certified by the FAA, which is recognized globally as the gold 
standard. A key component of every airplane certification is the 
process for delegation of authority. Delegated authority furthers 
the top priority of industry and Government, which is safety. The 
ability to delegate authority through team tasks enables FAA spe- 
cialists to focus on the highest-priority issues. 

Organizations that demonstrate strict accountability to certifi- 
cation requirements may receive what is called organization des- 
ignation authority, or ODA. It is a privilege that is hard to obtain, 
and it carries serious responsibilities. Notably, the FAA remains 
firmly in control, and ODA holders are governed by stringent re- 
quirements that include an FAA-approved process for selecting and 
training individuals to perform these delegated tasks. I can assure 
you that the members of the Boeing ODA are held to a very high 
standard, and are backed fully with the support of The Boeing 
Company. 

As mentioned, the certification process for the 787 was the most 
rigorous in Boeing’s history. It took 8 years and involved three 
times more conformed tests than the 777 certification program, 
three times more data submittals, twice as many airplane ground 
tests, and three times more integration tests. 

In closing, I would like to reiterate that certification is not the 
end of Boeing’s involvement in the safety of delivered airplanes. We 
collect and analyze enormous amounts of operational data. And 
when we spot a safety issue, we address the issue so that safety 
is maintained. This ongoing commitment to safety and the collabo- 
ration we find across aviation, coupled with our in-service moni- 
toring and data-driven risk management approach to designing 
new airplanes, are key reasons that flying is the world’s safest way 
to travel. Flying today is 70 times safer than driving. And in recent 
years there have been zero deaths from airline accidents here in 
the United States. None of this is happenstance. 

Mr. Chairman, this concludes my remarks, and I will be happy 
to answer any questions. Thank you. 

Mr. LoBiondo. Thank you. Could you tell us what you believe 
the lessons learned were from these two incidents? And what, if 
anything, you are doing in response to them? I mean other than 
the fixes, which I know are, you know, being put in place. 

Mr. SiNNETT. I think the first thing that I think of is that, be- 
cause of these incidents and the work that followed, Boeing and the 
team that we worked with advanced the state of the art for under- 
standing and testing lithium ion batteries. The test protocol that 
we had gone through up to this point had reflected the previous 
state of the art of the industry. And we worked, following these in- 
cidents, to push the state of the art so that we could cause a bat- 
tery to fail in a similar way as it failed on the airplane. So this 
was one of the areas. 

I think we also learned a significant amount about how to im- 
prove the processes in the manufacture and quality control of bat- 
teries, of lithium ion batteries. 

And lastly, and I think most importantly, these incidents vali- 
dated our design philosophy, which is that no single fault can put 
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an airplane at risk, and no combination of faults, even extremely 
remote, can put the airplane at risk. And again, these incidents 
validated — revalidated that design philosophy. 

Mr. LoBiondo. Some have suggested in the aftermath of the two 
incidents that somehow the FAA certification process was in some 
way lacking. How would you respond to that? 

Mr. SiNNETT. I would disagree. I believe that the certification 
process for the battery and for the airplane was extremely robust. 
The process takes into account the risks of a component failing, 
and the process takes into account the resulting impact on the air- 
plane. And, as Ms. Gilligan pointed out, while the incidents oc- 
curred and the battery did fail, the failure itself was contained at 
the battery level and did not put the airplane at risk. And the cer- 
tification approach ensures that that is the outcome. 

In a machine as complex as an airplane, there can be compo- 
nents that fail. We take those failures very seriously, and we work 
to address them. An accident can be the cause of multiple links in 
a chain that fail. And any time we have an incident which can be 
considered the break of the first link in that chain, we take it seri- 
ously. The incident was referred to as potentially impacting safety, 
and that is because the first level of the — of redundancy was com- 
promised, and that is the first link in the safety chain. And so we 
take it very seriously. 

Mr. LoBiondo. OK, thank you. Mr. Larsen? 

Mr. Larsen. Thank you, Mr. Chairman. Mr. Sinnett, back to that 
first question I asked Ms. Gilligan about self-certification. If you 
could imagine, again, the book-ends being — where people call it 
self-certifying, where they give the company — “Just go do some- 
thing and come back and tell us what you did and we will check 
the box,” versus the FAA crawling all over it every day, in control, 
and then says, “Here, take it and do this.” How would you charac- 
terize the certification process, if those were, in fact, the book-ends? 

Mr. Sinnett. I would say that it was somewhere in the middle. 
The way the delegation works, the FAA looks at the tasks at hand, 
and it considers which tasks are safety-related, and it retains those 
safety-related tasks. In areas where the tasks are more relatively 
mundane, typical of what you do day in and day out in the cert 
process, they may delegate those tasks to the delegated organiza- 
tion. 

In the case of the battery, the initial battery certification, the 
FAA retained the items that were inherently safety related. For ex- 
ample, the FAA retained approval of the certification plan. They 
also retained approval of the safety assessment following all the 
testing of the battery. Those were the two items that were most im- 
portant in establishing the safety of the battery system, and in as- 
suring that, as we — as the applicant, Boeing, showed compliance, 
that the FAA was able to find compliance to the safety-related as- 
pects. 

The other things that they delegated, things like tests to set up 
conformity, witnessing of certain environmental tests, those aren’t 
necessarily germane to the safety of the overall system and the 
overall design. Really, the keys to the kingdom there are the cer- 
tification plan itself, how we propose to show compliance to all the 
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rules, and then the safety assessment, which ties all of the analysis 
and the results to the end safety product. 

Mr. Larsen. OK. Can you talk about the — what you called the 
new state of the art in testing? The old state of the art, if you will, 
we have discussed and NTSB discussed this nail penetration of a 
battery. And perhaps — I think we know now that it probably 
wasn’t the — should not have been a standard. Can you talk about 
what was the old state of the art and what you think the new state 
of the art on testing of lithium ion batteries are for this size of 
a 

Mr. SiNNETT. Sure. 

Mr. Larsen. You know 

Mr. SiNNETT. Sure. In the past, the failure modes associated with 
large lithium ion battery cells were — there were really two types of 
failure modes. One was a severe failure resulting from an over- 
charged condition, where the cell contains more energy than it was 
ever designed to contain, because of a failure of the charging sys- 
tem, or a failure of the charging procedures. That type of failure 
has led to open flame resulting outside of the battery cell, and has 
been an area of great concern, from a safety perspective, which is 
why the charging system comes under such scrutiny, and is so 
carefully designed. In the NTSB factual report, they have set aside 
any concern about overcharging as being one of the potential fail- 
ure modes of this battery. 

The only other failure modes that we are aware of are failure 
modes that result from short circuits inside the battery due to a 
number of different causes. Regardless of the cause, when those 
short circuits occurred, the net result at a cell level was simply the 
use of the — there is a burst disk on the side of the cell that opens 
when the cell pressure and temperature rises to allow the cell to 
safely vent. 

In all other cases, for a battery failure, for a cell failure, the only 
thing that has resulted is that disk opening and the battery vent- 
ing the electrolyte, which looks like smoke to you or I, but it is 
venting electrolyte with no flame. 

These particular cells had undergone more than 2 million hours 
of operation on the airplane without a failure, and had undergone 
millions of hours of operation in another industry, also without a 
failure. 

The test state of the art at that time was a nail penetration test. 
And when that nail penetration test was performed, it replicated 
every known failure mode of the cell, with the exception of over- 
charge. And so, while the cells would short circuit, their tempera- 
ture and pressure would increase, they would vent this electrolyte, 
which, again, looks like smoke. But in no cases were there ever 
flame, and in no cases was there ever propagation to another cell 
inside a battery. For that reason it was considered state of the art 
through, again, millions and millions of hours of operation. 

On the JAL airplane and on the ANA airplane, what we saw was 
some type of internal short circuit, but we don’t know yet what the 
root cause was, because that is still under investigation. But the 
net result was a more energetic release of energy from the cell than 
we had seen, either through the nail penetration testing, or from 
any of the previous testing. 
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And so, to replicate that, we had to put a significant amount of 
energy into the cell without overcharging. The only way that we 
knew how to do that was to wrap a cell with a heating element, 
and put on the order of 300 kilojoules of energy into the battery 
in the form of heat to heat up the cell so that it would burst its 
disk and vent the electrolyte. What we found in that process was 
that it was energetic enough that it released enough heat to cause 
other cells in the same battery to vent, as well. 

And so, when I think of the state of the art, we have advanced 
that state of the art to the point where now we can replicate a cell 
failure with sufficient energy to cause that venting to propagate to 
subsequent cells in the battery, and that is where the current state 
of the art is today. 

Mr. Larsen. Mr. Chairman, could I continue? 

Just to — for my edification, 300 kilojoules sounds like a lot. Can 
you just explain — I am sure everyone else here knows what a 
kilojoule is. Could you just explain what a kilojoule is? I don’t’ 
know what it is, so 

Mr. SiNNETT. It is — a good way to think about it is — the cell of 
the battery, that is about 30 percent more energy than that cell 
contains when it is fully charged. So you can think about over- 
charging a cell by about 30 percent. That is the amount of energy 
that we are talking about. 

Mr. Larsen. Oh, OK. I will have a second round. 

Mr. LoBiondo. Ms. Johnson? Questions? 

Ms. Johnson. [No response.] 

Mr. LoBiondo. No? Back to you. 

Mr. Larsen. Sure, great, thanks. So, with the new state of the 
art, would you argue, then — would you argue that that will be the 
state of the art? Is that going to get in the literature for the next 
lit review, and this is how you are supposed to be doing it because 
we know better now? 

Mr. SiNNETT. I would imagine that for the immediate near term 
it would be, until somebody thinks up a better way to do it. 

One of the ways we might not like it is that it is overconservative 
at this point. We add a lot of energy to the battery to make it do 
what it does. And you never want to be overconservative, you kind 
of want to hit the sweet spot. But for right now, being overconserv- 
ative is better than being 

Mr. Larsen. And by overconservative, you mean you are really 
stressing the battery beyond what anyone would ever think it 
would be doing. 

Mr. SiNNETT. That is correct. 

Mr. Larsen. Yes. So it ends up not being a realistic situation? 

Mr. SiNNETT. It encompasses all realistic situations and then 
some. And it gave us great confidence with the battery enclosure 
that we have designed to go around the battery. 

In fact, in our certification testing on the airplane, with the air- 
plane operating and the engines running, we wrapped that same 
heater element around a cell inside the battery in the newly de- 
signed enclosure, and we put that same amount of heat into that 
batte^ cell and caused the battery to fail on the airplane, while 
the airplane was operating, pilot is on board, engines running, in 
a conformed certification test, and demonstrated that, even while 
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that single cell failed, the battery continued to operate for the next 
hour, and the airplane continued to operate normally throughout 
the entire event. 

Mr. Larsen. Are you involved with the ODA process? 

Mr. SiNNETT. I am involved as the applicant. And inside Boeing 
we kind of have a firewall between the delegated organization and 
the applicant, which is the designer, the builder, the requester of 
the certificate. I am the designer and builder. 

Mr. Larsen. OK. You are getting at the crux of my question. Be- 
cause if Boeing is an ODA or has an ODA designation, we have 
FAA working with the ODA within an organization, but that orga- 
nization also then is designing, building the equipment, in this case 
an airplane. How do you keep those separate? Because, you know, 
the watcher is watching the ODA. The ODA is supposed to be 
watching the maker. But if the ODA and the maker are under one 
roof, then how do we — how would we look at that and say, “Well, 
we need to have more separation”? 

Mr. SiNNETT. It is a — to a large degree, it is a process-based sep- 
aration that is rooted in our culture. For example, while we are a 
designated organization today, we have always had designed rep- 
resentatives of the FAA performing aspects of the showing of com- 
pliance. 

Now, since I started in Boeing commercial airplanes 23 years 
ago, it has been my history that I was taught from the very begin- 
ning that when a Boeing engineer is acting on behalf of the FAA, 
they are completely independent, and they have — they cannot come 
under any undue management pressure to do something that is 
against what they would term as best, from an FAA perspective. 
And that is deeply rooted in our culture. One of the quickest ways 
to see disciplinary action as a manager is to provide any undue in- 
fluence over a designated representative of the FAA. And it is in 
our absolute culture to make sure that they are independent from 
that perspective. 

We believe that for a couple of reasons. One, it is one of the pri- 
mary legs in the safety stool. It — our whole industry relies on that. 
Second, we also understand that, without that, the certification 
process itself would take much longer than it does today, and the 
net product would probably not be as good as it is today, because 
we wouldn’t have the expertise of the individuals who know as 
much as they do about the individual systems. 

Mr. Larsen. Presumably, the FAA could pull an ODA status, as 
well, if there were any problems. 

Mr. SiNNETT. That is right. The FAA can pull that privilege from 
us at any time, if we are not performing it appropriately. And, like- 
wise, the FAA can take an individual who is performing as a dele- 
gated representative and remove that individual, as well. 

Mr. Larsen. Yes. I will explore that a little more with the FAA, 
I think. 

I have got one last question, and it has to do with all those air- 
planes sitting on the tarmac in Paine Field. And I know you are 
moving to get those delivered, and very happy about that. But it 
goes to the changes, now that you have the — ^you have signed off 
on the new change of the new system with the box and the vent. 
And then, incorporating that now into the production process and 
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moving those planes out, is that — does that need to be separately 
certified, as well? 

Mr. SiNNETT. That change 

Mr. Larsen. The process of changing them out, putting the new 
boxes in. 

Mr. SiNNETT. Yes. There were two separate certifications. One 
was really related to the basic type design of the airplane 

Mr. Larsen. Right. 

Mr. SiNNETT [continuing]. Changing to incorporate it. And the 
other was a certification of the service bulletin that is performed 
by the airlines to make that modification. Boeing teams did that 
modification work for the airlines, but that was under the service 
bulletin that had been approved by the FAA. 

Mr. Larsen. Any involvement in developing that certification for 
the process includes management engineers and machinists on the 
line, making sure everybody is working off the same page? 

Mr. SiNNETT. That is correct. 

Mr. Larsen. Yes. 

Mr. SiNNETT. Right. 

Mr. Larsen. That is it. Thanks. 

Mr. LoBiondo. ok. Mr. Sinnett, we thank you very much, and 
the subcommittee stands adjourned. 

Mr. Sinnett. Thank you. 

[Whereupon, at 11:22 a.m., the subcommittee was adjourned.] 
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TRANSPORTATION AND INFRASTRUCTURE, SUBCOMMITTEE ON AVIATION, 
STATEMENT OF MARGARET M. GILLIGAN, ASSOCIATE ADMINISTRATOR, 
FEDERAL AVIATION ADMINISTRATION, BEFORE THE HOUSE COMMITTEE ON THE 
CERTIFICATION OF THE BOEING 787 AIRCRAFT AND THE LESSONS LEARNED, 
JUNE 12, 2013. 

Chaimaan LoBiondo, Congressman Larsen, Members of the Subcommittee: 

Thank you for the opportunity to appear before you today to discuss the Federal Aviation 
Administration’s (FAA) certification of the Boeing 787 airplane. There were two widely 
reported incidents earlier this year involving the malfunction of one of the Lithium-Ion batteries 
on in-service 787s that resulted in the FAA grounding the fleet and initiating a comprehensive 
safety review of the 787 critical systems, including design, manufacturing, and assembly. 

Today, after extensive design and certification work, 787s are once again part of the commercial 
fleet, flying passengers safely around the world. The comprehensive review will be completed 
this summer. 

FAA Certification Process 

The FAA certifies aircraft and components that are used in civil aviation operations. Some 
version of our certification process has been in place and served us well for over 50 years. This 
does not mean the process has remained static. Since 1964, the regulations covering certification 
processes have been under constant review. As a result, the general regulations have been 
modified over 90 times, and the rules applicable to large transport aircraft, like the 787, have 
been amended over 130 times. The regulations and our policies have evolved in order to adapt to 
an ever-changing industry that uses global partnerships to develop new, more efficient and safer 
aviation products and technologies. 
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As this committee knows, the FAA is using a risk based approach to improving aviation safety. 
The FAA focuses its efforts on those areas that have the highest risk. The FAA type certification 
team members, who I will discuss in more detail below, must review the applicant’s design 
descriptions and project plans, determine where their involvement will derive the most safety 
benefit, and coordinate their intentions with the applicant. When a particular decision or event is 
critical to the safety of the product or to the determination of compliance, the FAA must be 
involved either directly or through the use of our designee system. 

The designee program was originally authorized by Congress in 1938 and is critical to the 
success and effectiveness of the certification process. In aircraft certification, both individual 
and organizational designees support the FAA. The FAA determines the level of involvement of 
the designees and the level of FAA participation needed based on many variables. These 
variables include the designee's understanding of compliance policy; consideration of any novel 
or unusual certification areas; or where adequate standards may not be in place. 

There are some issues that will always require direct FAA involvement, including rulemakings 
required to appro ve special conditions and equivalent level of safety determinations. The FAA 
may choose to be involved in other project areas after considering factors such as our confidence 
in the applicant, the applicant’s experience, the applicant’s internal processes, and confidence in 
the designees. 

Something that is not well understood about the certification process is that it is the applicant’s 
responsibility to ensure that an aircraft conforms to FAA safety regulations. It is the applicant 
who is required to develop the plans and specifications and perform the inspections and tests 
necessary to establish that an aircraft design complies with the regulations. The FAA is 
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responsible for determining that the applicant has shown that the design meets the standards. We 
do that through review of data and by conducting risk based evaluations of the applicant's work. 

When a new design of aircraft is being proposed, the designer must apply to the FAA for a type 
certificate. While an applicant usually works on its design before discussing it with the FAA, w'e 
encourage discussions with the FAA well in advance of presenting a formal application. Once 
an applicant approaches us, a series of meetings are held both to familiarize FAA with the 
proposed design, and to familiarize the applicant with the applicable certification requirements. 

A number of formal and infomial meetings are held on issues ranging from technical to 
procedural. Once the application is made, issue papers are developed to provide a structured 
way of documenting the resolution of technical, regulatory, and administrative issues that are 
identified during the process. 

The applicant must show that its design meets applicable existing airworthiness requirements. 
Title 14 of the U.S. Code of Federal Regulations Part 25 comprises the safety requirements for 
transport category airplanes. The regulations also provide for the issuance of special conditions 
when the FAA finds that the existing airworthiness standards do not address new or novel design 
features. 

When the FAA proposes to apply special conditions to an airplane design, a notice of proposed 
special conditions is published in the Federal Register and the public has an opportunity to 
comment. As is the case with other rulemakings, those comments are considered and addressed 
before the special condition is finalized. This process is intended to allow important innovation, 
while maintaining the level of safety consistent with tlie existing regulations. Special conditions 
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address the unique risks associated with a particular new technology. They do not replace 
general safety requirements, they supplement them. 

Once the certification basis is established for the proposed design, the FAA and the applicant 
develop and agree to a certification plan. In order to receive a type certificate, the applicant 
must conduct a series of tests and reviews to show that the product is compliant with existing 
standards and the special conditions. This includes analysis, lab tests, flight tests, conformity 
inspections, and detail-and airplane-level compliance findings, all of which are subject to FAA 
oversight. If the FAA finds that a proposed new type of aircraft complies with safety standards, 
it issues a type certificate. 

FAA Certification of the Boeing 787 

Using the framework described for obtaining a type certificate for a proposed airplane design, I 
would like to provide some information about the certification of the Boeing 787. Boeing first 
applied for a type certificate for this aircraft on March 28, 2003. The FAA formed a certification 
team comprised of certification engineers, inspectors, flight test pilots, flight test engineers, 
human factors specialists, technical advisors, specialists from the FAA Technical Center, and 
several of our Chief Scientists in various disciplines. The team was supplemented by experts 
from other aviation authorities, industry technical organizations such as RTCA and SAB, and 
government, such as the DOT’S Volpe Center. As a result of regular meetings between the FAA 
and Boeing teams, FAA identified a number of design features of the proposed airplane where 
the curtent standards did not address the new or novel features, including the lithium ion main 
and auxiliary power unit (APU) batteries. At that time, there was a general standard - an FAA 
regulation - for the design of nickel cadmium and lead acid batteries, but these standards did not 
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fully address the safety issues associated with lithium-ion battery systems. Therefore, the FAA 
developed a special condition to establish a comparable level of safety with the standards that 
were in place at the time of certification. 

In order to develop the special conditions necessary to achieve the equivalent level of safety 
required for certification, we reviewed the available lithium battery literature. This also included 
consideration of the hazards of other battery technologies, such as nickel cadmium batteries. 

This review and analysis resulted in an issue paper, which led to publication in the Federal 
Register of proposed special conditions on April 30, 2007. The special conditions identified 
requirements to produce a level of safely equivalent to existing requirements in place for other 
types of batteries. The special conditions became effective in November 2007 and supplemented 
the existing part 25 requirements. 

The development and approval of the special conditions focused on two related safety concepts; 
the ftmcfion the system performs, and the hazards associated with its failure. The primary 
governing rule, part 25.1309, establishes general requirements for system safety. There is also 
an Advisory Circular that accompanies the rule that describes methods applicants can use to 
describe and analyze systems to demonstrate compliance. System descriptions and functional 
hazard assessments help us understand what happens to system functions when failures occur. 

With respect to the lithium ion batteries, from a functional standpoint, they were not critical 
because they were only intended to provide power if some of the six generators on the airplane 
failed. 

In summary, the certification of the Boeing 787 required extensive FAA involvement over an 
eight year period. A total of 150 issue papers were developed. Engineers spent thousands of 
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hours on the certification. There were over 900 hours of flight testing during the process. The 
certification process was detailed and thorough, but, as is the case with new'ly certified products, 
we often learn more about the product after it is certified and gains service experience. As we 
obtain pertinent information, identify potential risk, or learn of a system failure, we analyze it, 
we find ways to mitigate the risk, and we require operators to implement the mitigation. And 
that is what happened in the case of the 787. 

787 Incidents and the Decision to Ground the Fleet 

New products and technologies, in all industries, often have operating failures when they first go 
to market. Aviation is no different, but the consequences of failure can be so much more 
significant, that mitigations of potential failures are built into the certification process. On 
Januai'y 7, 2013, when a battery on the 787 operated by Japan Airlines (.TAL) overheated and 
stalled a fire on an empty aircraft at Boston Logan Aiiport, FAA immediately investigated the 
incident. On January 11, 2013, FAA announced a comprehensive review of the 787’s critical 
systems, including the design, manufacture and assembly of the aircraft. The Japan transport 
ministry and the National Transportation Safety Board also opened investigations. On January 
16, an All Nippon Airways (ANA) 787 made an emergency landing at Takamatsu Airport after 
flight crew received a computer warning that there was smoke inside one of the electrical 
compartments. ANA said that there was an error message in the cockpit indicating a battery 
system malfunction. 

Far and away the most important fact concerning these incidents is that no one on board the 
aircraft was injured. Even when the battery system failed in flight, the incident did not result in 
injury to anyone on board. This is in part because the FAA certification process requires 
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manufacturers to assume that system failures will occur and to design mitigations for those 
failures to protect the aircraft so that no injury occurs to persons on board the aircraft. From a 
certification standpoint, that goal was met. 

After the second event, we gathered all the data we had. Given the limited operational 
experience we had with the airplane, the fact that the two battery events occurred in quick 
succession, and that one of the events occurred in flight, we decided to ground the fleet. This 
would allow us to take the time necessary to develop and implement the right safety solution 
without compromising safety. 

Prior to January, the FAA had not grounded an aircraft fleet since the DC-10 inl979, .so this is 
not an action the agency takes lightly. Unlike that previous fleet grounding, the 787 was 
grounded, despite the fact that the incidents, thankfully, did not result in death or injury to 
passengers or crew. 

The accident rate for commercial aircraft operations is at an all time low. Neither the public nor 
the FAA has the tolerance for that accident rate increasing. Failures of systems on airplanes with 
hundreds of thousands of flight hours provide us with a tremendous amount of service data we 
can use to put an operational incident into the appropriate context and determine the 
corresponding mitigation. When the number of flight hours that can be evaluated is limited, 
FAA’s ability to develop an appropriate mitigation is more challenging. 

Grounding the 787 fleet gave the FAA the ability to consider necessary mitigations without 
compromising passenger safety. The fact that the incident was limited in nature helped us focus 
our analysis and agree upon a mitigation that could be implemented. 
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T ost Grounding Review 

The comprehensive review of the Boeing 787 and the root cause analysis of the two battery 
incidents was a data driven process. Based on past accident investigations, we know that, while 
it is sometimes not possible to determine the actual cause of an incident, that does not prevent us 
from developing effective mitigations to prevent further malfunctions. 

Boeing, with support from industry and government battery experts, conducted a comprehensive 
review of the design of the battery systems. Based on the infonnation obtained from the review, 
the focus of mitigation efforts was on the possible causes that could result in an internal short 
within the cells and the battery. The changes Boeing proposed addressed the initiation of a short, 
propagation of the malfunction from one battery cell to another, and containment of the event 
should another propagation occur. FAA specialists were involved in developing the mitigation 
effort throughout the process. 

On April 19, 2013, after Boeing completed the certification plan and demonstrated compliance 
with the standards, the FAA approved Boeing’s design for modifications to the 787 battery 
system. The changes were designed to address risks at the battery cell level, the battery level, 
and the aircraft level. A team of FAA certification specialists observed the rigorous tests we 
required Boeing to perform. They devoted weeks to reviewing the detailed analysis of the design 
changes. 

On April 26, 2013, the FAA issued an Airworthiness Directive (AD) superseding the previously 
issued AD mandating that operators install of the main and auxiliary power (APU) unit battery 
enclosures and environmental control system ducts; and replacing the main battery, APU battery. 
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and their respective battery chargers. This AD also requires revision of the maintenance 
program to include an airworthiness limitation reflecting a requirement to replace certain parts 
related to the battery enclosure. 

To assure proper installation of the netv design, the FAA closely monitored modifications to the 
U.S. fleet and staged teams of inspectors at modification locations. Further, as the certifying 
authority, FAA continues to provide support to other authorities around the world as they finalize 
their own acceptance procedures. 

Lessons Learnct l from the 787 Certification Process 

The FAA has a standard review of the process of every design we certify. Short terra, we often 
find administrative and procedural issues that are immediately evident and can be implemented 
for the next certification. For example, with respect to the 787, while the “multi-tiered supplier” 
dynamic is not new to industry, the FAA has determined that we need to spend more time 
overseeing communication and ensuring a clear line of accountability of all required changes 
down the supplier chain. We also look for ways to improve the integrity of the process with the 
addition of independent review of the work done. 

While understanding the lessons learned as the result of a technical failure can take time because 
the root cause is not readily evident, the F.AA has demonstrated its ability to develop mitigations 
W'hich ensure the safety of passengers and crew. In cases such as the flammability of the center 
fuel tank or the 737 rudder malfunctions, mitigations had to be developed that we were confident 
protected the passengers and crew without knowing the exact root cause of the particular 
problem. For example, it was not possible to know what caused the spaik that caused the 
explosion in the center fuel tank and brought down TWA Flight 800, The safest path to 
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mitigation was to find a way to inert the center foe) tank, so that, regardless of what caused the 
spark, no harm could result. With respect to the 737 rudder system, which was the cause of two 
fatal accidents in the 1990s, operational, procedural, training and design changes were 
implemented to protect flights from potential malfunctions. 

Technical Expertise 

Finally, I would like to address the concern expressed by some that FAA’s use of aviation 
e.xperts who do not work for the FAA suggests that we do not have the requisite expertise to 
resolve technical problems as they arise. Such concerns are unfounded. The aviation industry is 
filled with intelligent, innovative people. Certification of aviation products and systems is not 
limited to the participation of a single certifying entity and a single manufacturer, it is a 
worldwide industry and any new airplane design contains parts and products made by hundreds 
of companies in dozens of countries. Certification of an airplane, in the United States or abroad, 
requires the efforts of the best and brightest minds. FAA seeks the participation of industry 
experts who can add a level of safety or knowledge that can improve the process or the product. 
Likewise, when, as an industry, we face a problem, bringing together the best and the brightest 
mind.s to work on solving the problem and making industry-wide safety improvements, should be 
considered a best practice. Limiting the use of technical experts because of who they work for is 
the equivalent of imposing limitations on problem solving. Tliat is not a limitation that FAA 
would ever support. 

Mr. Chairman, I hope this hearing helps the Committee understand the complexity of the 
certification process and the commitment of industry and FAA to support both the certification 
of new and innovative technologies and work to resolve problems as they arise. I am proud of 
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the safety record we have achieved together. I am confident we have the best people in place to 
meet the challenges ahead. 

This concludes my prepared statement. I will be happy to answer your questions at this time. 
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Ms. Margaret Giliigan 
Associate Administrator for Aviation Safety 
Federal Aviation Administration 
800 Independence Avenue S.W. 

Washington^D.C. 20591 

Dear Ms. Giiligan: 

I thank you for your testimony before the Subcommittee on Aviation on June 12, 2013, 
regarding Lessons Learned from the Boeing 787 Incidents. I would appreciate your written 
response to the following questions for the hearing record. 

1) Would you please briefly explain Organization Designation Authorization (ODA)? 
What types of certification activities are delegated to companies like Boeing? 

2) What are some of the requirement for a company to be granted ODA? 

3) Would you please explain how the Federal Aviation Administration (FAA) conducts 
oversight of companies that are granted ODA? 

4) In April, the FAA testified before that National Transportation Safety Board that during 
the development of certification plans and compliance activity, the FAA determines its 
level of involvement through risk-based methods. Would you please explain the factors 
that make up the FAA’s risk-based analysis? 

5) I have heard from some of ray constituents about their difficulties in securing ODA 
designation to allow them to conduct their own Supplemental Type Certifications. What 
is FAA doing to implement recommendations from the report on aircraft certification 
required by Section 3 1 2 of die FAA Modernization and Reform Act of 20 1 2? 



39 


Ms. Margaret Gilligan 
June 25, 201 3 
Page 2 

6) Does tiie 787 incident have any effect on FAA’s progress in implementing efficiency 
gains in certification that Section 312 was (tesigned to address? 

7) How many fiiil-time employees (FIBs) does FAA have working on certification issues? 
Of these employees, vdiat is tlie breakdown of those working to certify new technologies? 

I would appreciate your written responses no later than July 9, 2013. Thank you again for 
your testimony. 


Sincerely, 


— =» 

RICK LARSEN 

Ranking Democratic Member 

Subcommittee on Aviation 

Committee on Transportation and Infrastructure 
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1. Would you please briefly explain Organizational Designation 
Authorization (ODA)? What types of certification activities are 
delegated to companies like Boeing? 

ANSWER: 

Organization Designation Authorization (ODA) is an FAA issued authorization 
for qualified individuals (two or more) within organizations involved in aircraft 
manufacturing, modification or repair or in an airline involved in aircraft repair or 
modification activities. The authorization allows the organization to do routine 
functions on behalf of the Administrator, and thereby allow FAA resources to 
focus on more critical safety matters. Boeing Commercial Airplanes holds an 
ODA authorization associated with engineering and production activities for 
current aircraft models (e.g. Boeing 777) and previously produced aircraft models 
(e.g. older Boeing 737 models). 

To become a delegated organization, the organization must demonstrate specific 
regulatory knowledge, industry experience and integrity. All FAA aircraft 
certification approvals are conducted in accordance with established regulations 
(14 CFR Part 21) and guidance. These standards do not allow a delegated 
organization to deviate from what is required for regulatory compliance. 
Additionally, delegated organizations maintain regular communication with the 
FAA staff and perform that work under FAA oversight. 

As part of our certification processes, the FAA determines our level of 
involvement based on a number of risk-based factors, including the safety 
criticality of the design, the clarity of the requirements and guidance, and the 
experience/competency level of the applicant and their delegation system. 

Typical functions for an ODA, including Boeing include the following: 

a. Approve technical data that demonstrates compliance to airworthiness 
standards 

b. Conduct inspections or witness tests to demonstrate compliance with 
airworthiness standards 

c. Inspect (conform) parts and articles to confirm they match the design 

d. Issue airworthiness certificates or approvals for delivery of new aircraft to US 
and international operators 

e. Approve operational or repair information for in-service 
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2. What are some of the requirements for a company to be granted 
ODA? 


ANSWER: 

The organization must have experience performing certification work and 
demonstrated its capability to successfully conduct any functions authorized 
under the ODA. This includes a thorough working knowledge of the regulations 
and FAA policies related to the functions authorized. Also, it must have a staff of 
individuals in its organization who meet the qualification requirements needed to 
perform any function, and it must institute an organizational model which ensures 
that the ODA staff is able to perform its functions without any influence from 
other parts of the organization. 

The organization must develop and implement an FAA-approved procedures 
manual describing how it will perform any authorized fimctions and administer 
the ODA, including; internal training requirements, self-audit requirements, and 
selection and approval processes for the ODA staff. 
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3. Would you please explain how the Federal Aviation 

Administration (FAA) conducts oversight of companies that are 
granted ODA? 

ANSWER: 

The FAA has an established oversight program that requires ongoing supervision 
that meets minimum annual requirements, as well as formal inspections of the 
ODA holder every 2 years. This oversight is conducted by an organization 
management team (OMT) consisting of FAA personnel skilled in all the functions 
delegated by the authorization. All OMT members are required to assess the 
performance of the ODA holder in the member’s technical area. 

Oversight focuses on ODA system aspects; monitoring compliance with the 
approved procedures manual and the adequacy of those procedures. 

Oversight includes review of all FAA functions performed by the organization. 
This can be done by the witnessing of particular functions, participation during 
certification activities, and the post-review of records and data. 
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787 Lessons Learned Hearing 


4. In April, the FAA testified before the National Transportation Safety 
Board (NTSB) that during the development of certifieation plans and 
compliance activity, the FAA determines its level of involvement 
through risk-based methods. Would you please explain the factors 
that make up the FAA’s risk- based analysis? 

ANSWER: 

The FAA Aircraft Certification Service uses risk based methodologies to assign risk 
levels to Production Approval Holders that manufacture aviation products and 
articles. These risk levels establish the FAA’s frequency and level of oversight. 

The FAA’s Aircraft Certification Service uses a Risk Based Resource Targeting 
(RBRT) model to assign risk. RBRT uses input factors (known as indicators) to 
identify and categorize the risk associated with oversight of individual production 
approval holders. The organizational indicators include: Quality System, 
Supplier/Outsourcing, Organizational Stability, Relationship with the FAA, and 
Compliance History. The Technical indicators include: Complexity, Service 
Experience, Applicant/Production Approval Holder Experience, and New/Emerging 
Technology. In addition, the criticality of the product or article to be manufactured is 
factored into the risk determination. There are a total of thirty-four specific factors 
within the organizational and technical indicators that are used at least once a year to 
assess the risk of FAA production approval holders. Upon determining the level of 
risk for each production approval holder, the FAA then determines the amount of 
oversight required. 
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5. I have heard from some of my constituents about their difficulties 
in securing ODA designation to allow them to conduct their own 
Supplemental Type Certifications. What is FAA doing to 
implement recommendations from the report on aircraft 
certification required by Section 312 of the FAA Modernization 
and Reform Act of 2012? 


ANSWER: 

As required by Section 312 of the FAA reauthorization, the FAA formulated an 
aviation rulemaking committee (ARC) with industry stakeholders to review and, 
where applicable, modernize or reform our certification processes. Our Report to 
Congress on that ARC was delivered on Aug 13, 2012. 

The ARC made a number of recommendations, several of which are already being 
implemented in the FAA Aircraft Certification Service. We have an 
implementation plan addressing all of the reconunendations. 

One of the six recommendations from the ARC involved more effective use of 
delegation. In support of this we are identifying ways to expand delegation 
provisions and also identifying changes to enhance the benefit of Organization 
Delegation Authorization (ODA) appointments for the FAA and industry. These 
activities are underway and will continue into 2014. 

In addition to the broader work associated with the Section 3 1 2 reauthorization, 
including the delegation system changes noted above, the FAA is also planning to 
prototype alternative ways to access the benefit of ODA appointment in smaller 
companies, such as the situation noted in your inquiry. This activity involves 
easuring FAA oversight practices are commensurate with the lower overall risks 
associated with the routine certification work these smaller organizations wish to 
do. If this concept proves to be feasible, a path for ODA appointment of smaller 
companies may be mutually beneficial to FAA and industry. These activities are 
underway now and will continue through 2014. Results from this prototype 
activity, along with the work being conducted by the Part 21 ARC, may be a basis 
for adjustments to national ODA policy. 
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Larsen QFRs 

787 Lessons Learned Hearing 


6. Does the 787 incident have any effect on FAA’s progress in 

implementing efficiency gains in certification that section 312 was 
designed to address? 


ANSWER: 

I’he FAA takes all incidents seriously. We systematically review ail safety 
incidents and we look for systemic or specific causes. Once the caxLses are 
identified, corrective actions arc taken to make improvements where necessary. 
The 787 incident will be treated in this same manner and lessons learned will 
guide appropriate changes and improvements to our certification processes and 
oversight activities. 

Section 312 also provides an opportunity for the Agency to implement changes, 
including activities related to how we measure the effectiveness (benefits) of 
certification process improvements and how they are sustained over longer 
periods of time. Currently, these two efforts do not specifically overlap and there 
is no specific effect on our Section 312 implementation plan stemming from the 
787 events. The FAA is now implementing changes addressing recommendations 
fi-om the Section 3 1 2 Aviation Rulemaking Committee and if findings from the 
787 incident were to affect any specific goal of the Section 312 implementation 
plan, the plan will be updated to show that change 
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Larsen QFRs 

787 Lessons Learned Hearing 


7. How many full-time employees (FTEs) does FAA have working on 
certification issues? Of these employees, what is the breakdown of 
those working to certify new technologies? 

ANSWER: 

The Aircraft Certification Service (AIR) currently has an onboard staffing level of 
1 253 (out of the 1 3 1 9 authorized). This includes 659 aerospace engineers, 248 
aviation safety inspectors, and 29 flight test pilots that are in direct support 
certification activities. In FY13, we estimate that AIR spent approximately 
408,000 hours on certification activities which converts to about 260 full-time 
equivalent (FTE) positions. AIR generally spends about 20% of its time in direct 
support of certification activities which includes type, production, and 
airworthiness certification. AIR’s technical employees are not assigned to only 
work certification issues. Activities in support of continued operational safety 
will normally take priority and their work is typically shifted from certification to 
continued operational safety when we are experiencing budget and staffing 
shortfalls, as we have in FY13. With a more stable budget and staffing resources, 
the time dedicated to certification-related projects would increase. 

AIR does not specifically track certification work on new technologies. 
Certification work is tracked by the type of approval being sought by the 
applicants, not the content of the design. However, in addition to those 
employees working certification projects, AIR employs 2 1 (5 are vacant) Chief 
Scientific and Technical Advisors (CSTA), Although the CSTA’s do not certify 
new technology, they are at the forefront of scientific and technological activities 
related to FAA research and development efforts. CSTAs are charged to 1) 
influence the research agendas of U.S. and foreign aviation industries, military, 
academia, and other research institutions, and 2) interact with and assist other 
U.S. Government agencies and foreign civil aviation authorities in technology- 
related issues. In addition, AIR employs 1 1 Facilities & Equipment positions that 
are dedicated to work associated with the implementation of NextGen technology. 
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statement of Mike Sinnett 

Vice President and Chief Project Engineer for the 787 Program, The Boeing Company 
Before the House Transportation and Infrastructure Committee, Subcommittee on Aviation 

June 12, 2013 

Chairman LoBiondo, Ranking Member Larsen, members of the Subcommittee, my name is Mike Sinnett, 
and I am the vice president and chief project engineer for the Boeing 787 program. 

It is my pleasure to appear before you today to support your continuing efforts to improve U.S. aviation. 
I know that you take that responsibility seriously, and I want you to know that Boeing is committed to 
supporting your work in any way that we can. 

Mr. Chairman, Boeing's highest priority is the safety of the passengers and crews who fly on our 
airplanes. Every Boeing employee is committed to safety. It is part of our DNA as a company, and it is 
that unwavering commitment that has helped to make air travel the safest form of transportation. Last 
year, as many of you may know, was the safestyear for commercial jet travel in history. 

Boeing has been in the airplane business for nearly 100 years, and we have been designing, 
manufacturing and servicing commercial jets for more than 50 years. We have delivered more than half 
of the commercial jets in service around the world today, and with every new airplane we create, we 
build on the knowledge we have gained from that broad, deep, and ever-increasing experience. 

The approach we take to every new airplane design employs methodologies that have served us well 
throughout our history as we have worked to ensure the highest level of airplane safety. It Is a data- 
driven approach In which risk is carefully assessed and managed. Our designs feature multiple layers of 
protection, and redundancy of critical systems, so that no single component failure, or even an 
extremely remote combination of failures, can endanger an airplane. 

The FAA has certified all of our airplane designs, indicating that they satisfy the agency's extensive safety 
requirements. It also has certified all of our production lines, indicating that we have established and 
shown that we can maintain a quality control system to ensure that each aircraft produced conforms to 
the approved design. And each aircraft that comes off of our assembly lines receives an airworthiness 
certificate indicating that it has been thoroughly checked out both on the ground and in flight and is 
ready for safe operation in commercial service. 

These certification processes are robust and recognized globally as the gold standard for airplane 
certification. They also have been continuously improved over the past 50 years. With each new 
airplane design, the certification process has become more rigorous. 

Importantly, this strong focus on safety by both industry and government continues long after our 
airplanes move through our factory doors - literally for as long as the airplanes remain in service, We 
continuously monitor the performance of our airplanes, carefully analyze the data we collect, share 
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safety-related findings with customers and regulatory authorities, and work with all relevant parties to 
Incorporate lessons learned into the active fleet and into new production aircraft and future designs. 

Boeing learned a great deal from the two highly-publicized events in January of this year involving 787 
lithium-ion batteries. These were significant events, which we took very seriously. We devoted more 
than 200,000 engineering hours to understanding the two events, to developing a comprehensive set of 
solutions that I will describe In a moment, and to working with the FAA to test and certify those 
improvements. We also fully supported, and will continue to fully support, the ongoing investigations 
into the two Incidents that the National Transportation Safety Board and the Japan Transport Safety 
Board are leading. 

Mr. Chairman, flying is as safe as it is because airplane manufacturers, regulators, airlines, airports, air 
traffic service providers, investigators and suppliers work together on safety and have done so for 
decades. We all share a firm commitment to safety, and we work with each other literally day in and day 
out. That is why we have been able to achieve such an impressive record - and why we are able to 
continuously improve upon that record. 

The 787 and Boeing's Response to Battery Incidents 

The 787 illustrates that deep commitment. The design process started, as it does with all of our new 
airplane programs, with a comprehensive reviewof everything the industry and its regulators have 
learned about designing, building and operating safe airplanes. For example, as part of the 787 design 
review we evaluated every safety issue on the 777 airplane to ensure that our 787 design addressed all 
of those issues. I have worked on the 787 program from its start, and I can personally attest to the 
team's strong focus on safety throughout the design, build, and test phases of the program. I also can 
attest to the strength of the certification process, which was more rigorous for the 787 than it was for 
any of our previous airplane programs, several of which I have worked on, including the 777. 

The result of all that hard work is an exceptional, safe and reliable airplane - the first commercial Jet of 
the 21*' Century, with a very strong, low-maintenance composite structure, 20% better fuel efficiency 
than the models it replaces, a lower cabin altitude and bigger windows, to name Just a few of its many 
innovative features. Over its initial 15 months of service, with eight airlines operating a total of 50 
airplanes, the 787 also achieved a schedule reliability rate of 98.2%. That is better than the 777 over Its 
first 15 months of service, which until the 787 came along was widely recognized as the best in its class. 

But as this Committee is aware, at the end of that 15 month period we experienced two 787 battery 
failures. On January 7, a Japan Airlines 787-8 experienced an auxiliary power unit battery failure while 
parked at Boston's Logan International Airport. No passengers or crew members were aboard the 
airplane, and none of the maintenance or cleaning personnel aboard the airplane were injured. Roughly 
one week later, an All Nippon Airways 787-8 experienced a battery failure during flight from Yamaguchi- 
Ube Airport to Tokyo. The crew diverted the airplane and performed a safe landing at Takamatsu 
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airport, in response to these incidents, the FAA and other regulatory agencies Issued directives 
suspending 787 operations that remained in effect for more than three months. 

As mentioned a moment ago, Boeing has worked diligently with the governmental bodies charged with 
investigating those incidents - the NTSB and JTSB - as well as the FAA and other civil aviation authorities 
responsible for ensuring the safety of the 787's lithium-ion batteries. Boeing worked around the clock, 
dedicating hundreds of its best engineers and consulting with experts in lithium-ion battery technology 
from across Industry and government. We appreciate the efforts of the government agencies that 
participated in that process, as well as those from our supplier-partners and other industries who 
supported our efforts to find a solution. We also are deeply grateful to our airline customers, who stood 
by us and remained confident in the promise of the 787 during a challenging period of significant service 
disruption. 

As we explained in our public testimony at the NTSB's recent hearing, the incidents -while serious - 
demonstrated the effectiveness of the design philosophy that I spoke about earlier. The airplane's 
redundant safety features prevented the battery failures from putting the airplane, its passengers, and 
crew in jeopardy. With that said, the work done in the wake of the two incidents revealed ways that we 
could improve the batteries, and on March 12 we received FAA approval of a certification plan for a 
proposed comprehensive and multi-layered set of battery system improvements. 

Our solution employed three layers of protection. First, we made design changes and manufacturing 
process enhancements that reduce the likelihood of a battery failure in the first place. Second, we 
proposed additional changes within the battery to reduce the probability that a cell failure will 
propagate from cell to cell. And third, we designed a new steel enclosure that Isolates the battery from 
the rest of the electronic equipment bay and which, in the unlikely event of a failure, will vent all battery 
vapors outside the airplane. Importantly, the enclosure's design minimizes the amount of oxygen inside 
the box, thus eliminating the possibility of a fire. 

Taken In combination, these improvements to the 787's battery system significantly reduce the 
likelihood of a battery failure and further ensure that should a failure occur there will be no significant 
impact on the airplane. After a series of rigorous certification tests, the FAA and other regulatory 
agencies gave 787 operators approval to resume commercial flights. We have high confidence In our 
solution, which enhances what was already a very safe airplane. But as mentioned earlier, we will 
continue to fully support the ongoing NTSB and JTSB investigations, and we will take into account any 
future findings those investigations may reach. 

The FAA was deeply Involved in the process that culminated in the certification of our battery solution. 
After the first incident, the FAA and Boeing began evaluating all of the known facts and data through the 
Continued Operational Safety Program, or COSP, a disciplined process established in 1999 to assess in- 
service Incidents. Using COSP, we determine whether an incident demonstrates a significant safety 
issue, and if so, we determine what immediate mitigating actions might be needed (if any) until a longer 
term, more permanent solution is found. 
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After the second battery Incident, the FAA and Boeing again evaluated the situation using the COSP 
process. And following the FAA Administrator's subsequent decision to suspend 787 operations, experts 
from the agency closely monitored the design work and the tests we conducted to validate the 
proposed improvements to the battery, and of course supervised the rigorous process that certified the 
new design. 

I will share more thoughts about certification in a minute because I know that Is a subject of great 
interest to this Committee. But first I want to give you an update on the status of the 787 fleet. I am very 
happy to report that the 787 modifications certified by the FAA have been completed on all of the 50 
airplanes that had been delivered prior to the suspension of operations, and as of June 4* all 50 were 
back in revenue service. In addition, Boeing has been delivering new 787s from its factories with the 
approved modifications since May 14. A great airplane has returned to the sky, and I am confident it will 
serve our airline customers and the traveling public extremely well for decades to come. 

The High Standards for Airplane Certification and Delegated Authority 

That confidence is rooted not only in my own experience on the 787 program, and with the Boeing team 
and outside experts from industry and government who worked on the battery solution, but also in the 
certification process that, like our airplane designs, has continuously improved through the years. It is a 
process wherein the FAA defines the requirements that a new airplane must meet, and the 
manufacturer demonstrates through FAA-approved analyses and tests that the designs, and the 
airplanes built to those designs, meet all FAA requirements, 

A key component of every airplane certification is the FAA's process for the delegation of authority. 
Delegated authority furthers the top priority of industry and government that I mentioned at the 
beginning of my remarks - safety. The ability to delegate authority for more routine certification tasks to 
qualified individuals enables FAA specialists to focus on the highest-priority issues. As the certification 
process has grown more robust, delegation also enables Boeing and the FAA to complete the 
certification process more efficiently and robustly. 

Delegation is nothing new. As a practice, it dates back to the late 19205. And when Congress created the 
current FAA in 1958, it correctly surmised that if FAA officials were to analyze and review compliance 
with every single certification requirement, it would require thousands of new engineers and inspectors, 
additional facilities, and likely hundreds of millions of dollars in new annual funding. Congress 
recognized the fiscal and practical necessity of using private sector expertise to keep pace with the 
growing aviation industry, and wisely gave the FAA authority to delegate certain certification activities 
to qualified persons- in effect enabling the agency to leverage its own resources by tapping into the 
considerable expertise of the private sector. 

For reasons of both effectiveness and efficiency, delegated authority has transitioned from Individual 
designations to organizational designations. Organizations that demonstrate and maintain strict 
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accountability to certification requirements and processes may receive what is called Organization 
Designation Authorization, or ODA. As the name implies, ODA status allows an organization to perform 
certain certification tasks on behalf of the FAA. It is a privilege that is hard to obtain and that carries with 
it serious responsibilities. Notably, the FAA remains in control of the certification process. It retains 
authority for approval and oversight of all ODA procedures, determines which portions of any given 
certification project are delegated, and retains ultimate and sole authority to issue airplane type 
certificates, 

ODA holders are governed by stringent FAA requirements that include having an FAA-approved process 
for selecting and training Individuals to perform the delegated tasks. In accordance with FAA 
procedures, the agency is notified when an individual is selected for ODA membership, and it is given an 
opportunity to participate in the evaluation of candidates and provide feedback. The FAA also retains 
the right to direct the removal of an underperforming member. 

I can tell you from personal experience that the members of the Boeing ODA are held to a very high 
standard. They are well qualified, well trained, and take their responsibilities as representatives of the 
FAA Administrator very seriously. These professionals focus intensely on one goal - to ensure full 
compliance with all FAA requirements. And they are, by design, and with the full support of the 
company, protected from pressures to cut corners or otherwise act in a manner inconsistent with FAA 
procedures and standards. Boeing has established communication channels that enable them to report 
undue pressure directly to senior management, as well as the FAA, which conducts oversight and formal 
audits. Members of the Boeing ODA also regularly check on each other through a system of peer 
reviews. 


The Robust Nature of the 787 Certification Process 


The certification process for the 787 was the most rigorous and comprehensive certification process in 
Boeing's history. Boeing applied for certification in March of 2003. It was an eight-year process, 
involving thousands of safety demonstrations, from design review to component testing to system and 
structural testing and finally to flight testing. The compliance checklist alone for the 787-8 was 3,342 
pages long. The thousands of topics on that list included such items as takeoff speeds, performance with 
one engine inoperative, stall characteristics, emergency lighting, material strength properties, bird 
strikes, warning lights, oxygen equipment, even the shape of the knobs on cockpit controls. 

It is hard to overstate the comprehensive nature and rigor of the 787 certification process, which 
involved three times more conformed tests than the 777 certification program, three times more data 
submittals showing compliance, twice as many airplane ground tests, and three times more integration 
testing. 

Beginning with the design phase, every element of the 787 was examined and evaluated to determine 
how it performed, both separately and in conjunction with other parts and systems. It was a top to 



52 


bottom evaluation, spanning everything from the raw materials used to make airplane parts to the 
overall performance of the airplane in flight. 

The 787's integrated electrical power system, which includes the batteries, underwent more than 5,000 
hours of component-level testing, followed by more than 25,000 hours of laboratory testing to 
demonstrate the battery's interaction with various system elements during normal operations as well as 
during simulated, abnormal failure conditions. At the airplane level, the integrated electrical system 
underwent more than 10,000 hours of testing under normal operating conditions and under simulated, 
abnormal conditions, including extreme weather, long and short flight durations, and low and high 
elevations. 

Two full-scale replicas of the 787 were created for static and fatigue testing of the airplane's structure. 
The wings and fuselage of one of the replicas were manipulated during static testing to simulate 
conditions far beyond what any airplane would ever experience in service. The second replica is 
undergoing fatigue testing that simulates the structural stress on the plane. That testing eventually will 
simulate a total of at least 132,000 flights. 

The first flight of the 787 occurred on December 15, 2009, and in April of 2010 the 787 began the FAA's 
extensive flight test program. Engineers demonstrated compliance with over 25,000 test conditions as 
part of the flight test program. 

The testing included multiple environments and scenarios. Take-offs and landings in extreme cross- 
winds were tested in Iceland. Cold weather starting was tested at minus 45 degrees Fahrenheit. Take- 
offs and operations with a single engine and simulated generator failures were demonstrated, along 
with a multitude of other simulated system failures. High altitude take-offs were tested in La Paz, Bolivia 
at an elevation of 13,000 feet. Take-offs and operations with the airplane overweight were tested, as 
were aborted take-offs and tail-strike take-offs. 

To obtain certification and to test the airplane's capabilities, multiple 787s logged over 1,700 flights 
during testing, flying for over 5,000 hours, including endurance flights. They performed ultra-long- 
distance flight tests, including an indirect route from Guam to Everett, Washington, that lasted 18 hours. 
The pilots simulated system and engine failures to demonstrate that the airplane could still safely reach 
a distant airport. The 787 also set new records for both speed and distance In its weight class by flying 
from Seattle to Bangladesh— 10,337 nautical miles, and around the world in under 42.5 hours. 

The FAA oversight was extensive during the flight test program and it observed and reviewed the tests 
using two methods. An FAA official was aboard for approximately 25 percent of the flight test hours. The 
tests conducted during the remaining hours were observed by Boeing personnel qualified and trained to 
act as FAA delegates during the certification process. 

One reason delegated authority and the overall certification process have worked so well is that both 
have evolved and improved in response to changing technologies and conditions in the industry. This 
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evolution must continue, Boeing Is grateful that this Committee recognized that fact in the FAA 
Modernization Act of 2012, which in sections 312 and 313 directed the agency to further improve its 
certification and regulatory processes. In response, a number of good recommendations have emerged 
via the Aviation Rulemaking Committee process, but they have not been fully adopted. On behalf of 
Boeing and others in the aerospace industry, I encourage the Committee to continue working with the 
FAA to ensure timely implementation of these Important recommendations. The Committee has 
provided a great opportunity through the reauthorization bill to achieve progress in this area, and our 
nation's aviation industry will be strengthened by your oversight of these provisions, 

Boeing's Commitment to Continued Safe Operations 

In closing I would like to return briefly to a subject I mentioned earlier in my testimony because it is such 
an important part of the aviation safety story. Certification is not the end of Boeing's -or the FAA's- 
involvement in ensuring the safety of the airplanes delivered to our customers, I mentioned that we 
track the performance of every airplane we build for as long as it is in service. We collect and analyze 
enormous amounts of operational data, and we are not alone in that regard. Airlines, manufacturers, 
and government regulators around the world collect, share and analyze the performance of the In- 
service fleet, and when we spot a safety issue, or see a troublesome trend, we work together to address 
the Issue or trend so that safety of flight is maintained. 

At Boeing, we established a formal, FAA-approved process 20 years ago to monitor the in-service fleet, 
identify emerging issues, make disciplined, data-driven safety decisions, and take corrective action 
where and when needed In coordination with our customers and the regulatory agencies. We called it 
the Boeing In-Service Safety Process, and in 1999 it evolved into the Continued Operational Safety 
Program that I mentioned earlier. 

Also in the 1990s we began regular, periodic reviews of safety Initiatives at other aerospace companies, 
at companies In other Industries, and at government agencies, both here in the United States and 
abroad. We regularly share best practices and key findings so that we can continue to advance the 
safety of flight. 

Collaborative action is essential to safe flight because, while we strive to design and build perfect 
airplanes and to anticipate ail potential problems, the unexpected sometimes happens and we learn 
something new. it is vitally important, therefore, that we have the people and processes in place to 
ensure that the learning never stops, that we continue to advance our knowledge of airplanes and the 
conditions in which they operate, and that we incorporate those valuable lessons learned into the active 
fleet and future designs so that safety issues and problems do not become fatal accidents. 

Our recent experience with 787 battery failures was both a surprise and a disappointment, but it also 
was a testament to why Boeing and the industry as a whole have achieved a superb safety record. Two 
batteries on separate airplanes failed. But since the safe management of potential component-level 
failures is central to our design philosophy, no one was hurt, and the damage to the airplane in both 
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cases was limited to the batteries and areas immediately around them. From that standpoint, what 
happened in Boston and Japan in January demonstrated a central tenet of our design philosophy. 

Furthermore, what happened In the wake of those two Incidents demonstrated our strong commitment 
to safety and the collaborative approach we take to ensuring safe flight. The unexpected occurred, 
talent was quickly brought to bear from both industry and government, a solution was found, tested and 
certified, modifications were implemented, and 7S7s are now flying again. 

The strong commitment to safety and the collaboration we find across the aviation world, coupled with 
our in-service monitoring and data-driven, risk management approach to designing new airplanes, are 
key reasons that flying is the world's safest way to travel. You no doubt have heard these statistics, but 
they are worth repeating here, it is 70 times safer to fly in a commercial jet than it is to drive a car. More 
people die every year by accidental drowning than have died over the past 30 years of commercial 
flying. In the decade from 1998 to 2008 the fatal accident rate for U.5. commercial airline operations 
dropped by more than 80 percent, and in several years recently there have been zero deaths from 
airline accidents here in the United States. 

None of this Is happenstance. 

Mr. Chairman, that ends my formal remarks. I thankyou forthis opportunity to testify before the 
Committee, and I will be happy to answer any questions.. 
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